Vulnerability GHSA-fm2x-c5qw-4h6f
Advisory details are being prepared in the background.
Critical
CRITICAL RISK
CVSS Score: 9.1
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
6 months ago
April 10, 2026 at 07:21 PM UTC
LXD: VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf
>=0.0.0-20210305023314-538ac3df036e <=0.0.0-20260226085519-736f34afb267
>=0.0.0-20210305023314-538ac3df036e <=0.0.0-20260226085519-736f34afb267
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
9 hours ago
LXD allows cross-guest volume hijack via DevLXD device patch in github.com/canonical/lxd
>=0.0.0-20250721152936-fe86ceb2c3fa <0.0.0-20260626085133-7cb96ac80a6d GO-2026-6917
>=0.0.0-20250721152936-fe86ceb2c3fa <0.0.0-20260626085133-7cb96ac80a6d GO-2026-6917
High Risk
15 hours ago
lxd allows Cross-guest volume hijack via DevLXD device patch
>=0.0.0-20250721152936-fe86ceb2c3fa <0.0.0-20260626085133-7cb96ac80a6d GHSA-hhf9-qw4v-72xp
>=0.0.0-20250721152936-fe86ceb2c3fa <0.0.0-20260626085133-7cb96ac80a6d GHSA-hhf9-qw4v-72xp
Unknown
2 months ago
Type field in restricted TLS certificate allows privilege escalation in github.com/canonical/lxd
v0.0.0-20261105145923-afa964e30b2c GO-2026-5306
v0.0.0-20261105145923-afa964e30b2c GO-2026-5306
Unknown
2 months ago
VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf in github.com/canonical/lxd
v0.0.0-20261105145923-afa964e30b2c GO-2026-5368
v0.0.0-20261105145923-afa964e30b2c GO-2026-5368
Unknown
2 months ago
LXD: Importing a crafted backup leads to project restriction bypass in github.com/canonical/lxd
v0.0.0-20261105145923-afa964e30b2c GO-2026-5576
v0.0.0-20261105145923-afa964e30b2c GO-2026-5576
Impacted packages
Timeline
Published
6 months ago
April 10, 2026 at 07:21 PM UTC
Last Modified
2 months ago
August 11, 2026 at 11:55 PM UTC