Lxd

This hub aggregates every CVE we track for Lxd, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Lxd.

• CVE-2026-66897Instance template path traversal allows arbitrary host file write as root9.9Aug 24, 2026
• CVE-2026-16033Arbitrary file read+write on host via templates/ symlink in malicious image8.5Aug 12, 2026
• CVE-2026-66898Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE9.9Aug 12, 2026
• CVE-2026-63293Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root9.9Aug 12, 2026
• CVE-2026-63294Root RCE via image backup.yaml symlink9.9Aug 12, 2026
• CVE-2026-63295Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated`4.3Aug 12, 2026
• CVE-2026-63296Project restriction bypass via instance migration config override9.9Aug 12, 2026
• CVE-2026-63297Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge9.9Aug 12, 2026
• CVE-2026-63298LXD arbitrary lxc.conf directive injection via NVIDIA instance configuration9.9Aug 12, 2026
• CVE-2026-63299Storage volume cross-project move and snapshot restore bypass project disk limits9.9Aug 12, 2026
• CVE-2026-62420Cross-project cluster migration bypasses project restrictions via cluster notification flag9.9Aug 12, 2026
• CVE-2026-63300Cross-project instance move bypasses all project restrictions allowing host command execution9.9Aug 12, 2026
• CVE-2026-28385SSRF via image import from URL allows internal network probing by authenticated users5.0Jun 26, 2026
• CVE-2026-9640LXD Snapshot Import Privilege Escalation Vulnerability7.2Jun 26, 2026
• CVE-2026-9639Authenticated Denial of Service via Malicious Backup Tarball in LXD6.5Jun 26, 2026