CVE-2026-9640

{
  "id": "CVE-2026-9640",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-26T16:16:37.250",
  "lastModified": "2026-10-25T17:10:00.197",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy restrictions by importing a maliciously crafted instance backup containing restricted configuration keys within a snapshot. When the snapshot is restored, these restricted keys are applied to the live instance without policy validation. Starting the modified instance grants the operator unauthorized host root access."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de escalada de privilegios existe en LXD desde 6.0 antes de 6.9, 5.21.0 antes de 5.21.5 y 5.0.0 antes de 5.0.7 con respecto al manejo de las políticas de restricción de proyectos durante la restauración de instantáneas. Un operador de proyecto autenticado en un entorno multiinquilino restringido puede eludir las restricciones de la política importando una copia de seguridad de instancia creada maliciosamente que contiene claves de configuración restringidas dentro de una instantánea. Cuando se restaura la instantánea, estas claves restringidas se aplican a la instancia en vivo sin validación de política. Iniciar la instancia modificada otorga al operador acceso root de host no autorizado."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Canonical",
          "product": "LXD",
          "defaultStatus": "unaffected",
          "packageName": "LXD",
          "platforms": [
            "Linux"
          ],
          "repo": "https://github.com/canonical/lxd",
          "versions": [
            {
              "version": "5.21.0",
              "lessThan": "5.21.5",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "5.0.0",
              "lessThan": "5.0.7",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "6.0",
              "lessThan": "6.9",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-26T00:00:00+00:00",
          "id": "CVE-2026-9640",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.12",
              "versionEndExcluding": "5.0.7",
              "matchCriteriaId": "847C5578-B73F-45BA-8E6E-C9F69B7E3254"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.21.0",
              "versionEndExcluding": "5.21.5",
              "matchCriteriaId": "BBD4ACC0-A547-4D52-B4E7-AD7ACD9D6081"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.0",
              "versionEndExcluding": "6.9",
              "matchCriteriaId": "C25E18E8-CDDF-4F3A-A80E-F27456981A4B"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/canonical/lxd/pull/18301",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://github.com/canonical/lxd/pull/18303",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://github.com/canonical/lxd/pull/18304",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://github.com/canonical/lxd/security/advisories/GHSA-ppq7-4492-5552",
      "source": "[email protected]",
      "tags": [
        "Exploit"
      ]
    },
    {
      "url": "https://github.com/canonical/lxd/security/advisories/GHSA-ppq7-4492-5552",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit"
      ]
    }
  ]
}