Description Summary:
A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations, potentially leading to unauthorized file access or overwriting.

Executive Summary:
A critical path traversal vulnerability in Canonical LXD allows authenticated attackers to bypass directory restrictions during backup restoration, posing a severe risk of host system compromise.

Vulnerability Details

CVE-ID: CVE-2026-66898

Affected Software: Canonical LXD

Affected Versions: 4.0.0 up to (excluding) 4.0.12, 5.0.0 up to (excluding) 5.0.4, 5.21.0 up to (excluding) 5.21.2, 6.0 up to (excluding) 6.1

Vulnerability: This is a path traversal flaw (CWE-22) occurring during backup import or restore operations. The application fails to validate instance and storage volume names within archive metadata, allowing an authenticated attacker to access or overwrite files outside the intended restore directory.

Business Impact

Successful exploitation allows an attacker to read sensitive configuration files or overwrite critical system binaries on the host. Given the CVSS score of 9.9, this vulnerability represents a critical risk of full container escape and host takeover, potentially leading to total loss of confidentiality, integrity, and availability of the host environment.

Remediation Plan

Immediate Action: Upgrade to LXD version 4.0.12, 5.0.4, 5.12.2, or 6.0.1 (or later) immediately as recommended by the vendor.

Proactive Monitoring: Review system logs for unusual backup import patterns or unexpected file access events originating from the LXD service.

Compensating Controls: Restrict the ability to import or restore backup archives to only trusted administrative users to minimize the attack surface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the high privileges required to perform administrative backup operations, but the risk remains theoretical in the absence of published exploit code.

Analyst Recommendation

The severity of this vulnerability necessitates an immediate patching cycle. Administrators should prioritize upgrading all instances of Canonical LXD to the fixed versions listed above to prevent potential host-level exploitation.

Description Summary:
A path traversal vulnerability in Canonical LXD allows authenticated users to escape container confinement and achieve host root code execution by overwriting arbitrary host files.

Executive Summary:
A critical path traversal vulnerability in Canonical LXD allows authenticated users with container permissions to escalate privileges to host root, posing a severe risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-66897

Affected Software: Canonical LXD

Affected Versions: 4.0.0 up to 4.0.13, 5.0.0 up to 5.0.9, 5.21.0 up to 5.21.7, 6.0 up to 6.10

Vulnerability: The vulnerability arises due to a discrepancy in how LXD processes template paths. While the software validates paths against a confined root directory, it subsequently uses unconfined string paths for file creation, allowing an authenticated attacker to perform path traversal and overwrite sensitive files on the host.

Business Impact

The ability to overwrite host-level files as root leads to a total compromise of the host system. With a CVSS score of 9.9, this vulnerability represents an extreme threat to infrastructure integrity, as it allows attackers to break out of containerized environments and gain persistent control over the underlying server.

Remediation Plan

Immediate Action: Upgrade LXD to versions 4.0.13, 5.0.9, 5.21.7, 6.10, or later immediately.

Proactive Monitoring: Audit container metadata configurations and monitor for unauthorized attempts to modify sensitive host system files or configuration directories.

Compensating Controls: Restrict the ability of untrusted users to launch or edit container images and templates until the patch is applied.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of Aug 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly severe because it directly circumvents container isolation, which is a primary security boundary for LXD environments.

Analyst Recommendation

Given the potential for complete host system takeover, this vulnerability must be treated as a high-priority incident. Administrators should verify their LXD versions and apply the provided security updates across all production clusters without delay.

Description Summary:
LXD fails to validate instance configurations during migration, allowing an authenticated attacker to bypass project-level security restrictions and escalate privileges.

Executive Summary:
A critical authorization bypass vulnerability in Canonical LXD allows authenticated attackers to circumvent project-level security policies, posing a high risk to container isolation.

Vulnerability Details

CVE-ID: CVE-2026-63300

Affected Software: Canonical LXD

Affected Versions: 5.0.0 up to (excluding) 5.0.8, 5.21.0 up to (excluding) 5.21.6, 6.0 up to (excluding) 6.10

Vulnerability: The instancePostMigration function fails to enforce security restrictions during instance migration. An attacker with low-level project creation privileges can move high-privilege instances into restricted projects, effectively bypassing intended security boundaries.

Business Impact

Successful exploitation allows an attacker to execute arbitrary code within containers or environments they should be restricted from accessing. Given the CVSS score of 9.9, this vulnerability represents a severe threat to multi-tenant environments, potentially leading to total system compromise, unauthorized data access, and the invalidation of security isolation policies.

Remediation Plan

Immediate Action: Upgrade LXD to version 5.0.8, 5.21.6, 6.10, or later immediately to apply the necessary authorization checks.

Proactive Monitoring: Review LXD audit logs for unusual migration activities or unexpected changes in instance security profiles within restricted projects.

Compensating Controls: Restrict the ability to create or migrate instances to trusted users only, and ensure project-level configurations are strictly audited until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 12, 2026, there is no confirmed active exploitation in the wild: however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous because it targets the core isolation mechanism of the virtualization platform.

Analyst Recommendation

This vulnerability is critical due to its ability to break core security boundaries in LXD. Administrators must prioritize the deployment of the provided patches to all affected nodes to prevent unauthorized privilege escalation and maintain container integrity.

Description Summary:
An OS command injection vulnerability in NVIDIA LXD instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives.

Executive Summary:
An authenticated command injection vulnerability in NVIDIA LXD allows attackers to execute arbitrary configuration directives, posing a high risk of system compromise.

Vulnerability Details

CVE-ID: CVE-2026-63298

Affected Software: NVIDIA LXD

Affected Versions: 4.0.0 up to (excluding) 4.0.12, 5.0.0 up to (excluding) 5.0.8, 5.21.0 up to (excluding) 5.21.6

Vulnerability: The software suffers from an OS command injection flaw (CWE-78) where special elements in NVIDIA instance configuration are not properly neutralized, allowing an authenticated attacker to execute arbitrary commands.

Business Impact

This vulnerability carries a CVSS score of 8.7, indicating high severity. Successful exploitation permits an attacker to escape container boundaries or gain elevated control over the host system, potentially leading to total system compromise, data theft, and unauthorized access to sensitive infrastructure.

Remediation Plan

Immediate Action: Upgrade to LXD version 4.0.12, 5.0.8, 5.21.6, or later, as provided by the vendor.

Proactive Monitoring: Inspect system logs for unusual configuration changes and monitor for unexpected process execution originating from the LXD service.

Compensating Controls: Implement strict role-based access control (RBAC) to limit the number of users capable of modifying instance configurations.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the potential for container escape.

Analyst Recommendation

Given the high CVSS score and the presence of a proof-of-concept, organizations should prioritize patching LXD instances immediately. Applying the vendor-provided updates is the only definitive way to neutralize the command injection vector.

Description Summary:
A time-of-check to time-of-use race condition in Canonical LXD allows authenticated users to bypass project security restrictions during cross-project instance copies.

Executive Summary:
Canonical LXD is susceptible to a critical TOCTOU race condition that permits authenticated attackers to bypass security restrictions when copying instances across projects.

Vulnerability Details

CVE-ID: CVE-2026-63297

Affected Software: Canonical LXD

Affected Versions: 5.0.0 up to (excluding) 5.0.8, 5.21.0 up to (excluding) 5.21.6

Vulnerability: The vulnerability involves a race condition (CWE-367) where restriction checks occur before configuration merging is complete. This allows an authenticated attacker to manipulate instance settings to circumvent security controls.

Business Impact

The ability to bypass project restrictions facilitates the deployment of insecure or high-privilege instances into restricted zones. With a CVSS score of 9.9, the impact on environment integrity is critical, as it undermines the primary security segmentation model provided by LXD projects.

Remediation Plan

Immediate Action: Apply the vendor-provided security update by upgrading to LXD version 5.0.8 or 5.12.6 or later.

Proactive Monitoring: Monitor API request logs for rapid, repeated instance copy operations that might indicate an attempt to exploit the race condition window.

Compensating Controls: Limit access to the instance copy functionality to highly trusted administrative roles to reduce the attack surface.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Race conditions of this nature are highly sensitive to timing and system load.

Analyst Recommendation

The reliance on timing for security checks makes this a high-priority item for remediation. Administrators should move quickly to patch their systems to ensure that configuration validation is performed correctly and atomically.

Description Summary:
An authorization bypass in Canonical LXD allows authenticated users to move instances into restricted projects while bypassing enforced configuration security controls during migration.

Executive Summary:
Canonical LXD contains a critical authorization bypass vulnerability that allows authenticated attackers to circumvent project security restrictions during instance migration.

Vulnerability Details

CVE-ID: CVE-2026-63296

Affected Software: Canonical LXD

Affected Versions: 5.0.0 up to (excluding) 5.0.8, 5.21.0 up to (excluding) 5.21.6, 6.0 up to (excluding) 6.10

Vulnerability: This is an incorrect authorization flaw (CWE-863) where the LXD migration process fails to validate instance configuration overrides against target project restrictions. The vulnerability requires an authenticated attacker to perform the migration.

Business Impact

Successful exploitation allows an attacker to introduce high-privilege or otherwise disallowed instance configurations into environments that should be restricted. Given the CVSS score of 9.9, this vulnerability poses a severe risk to multi-tenant isolation, potentially enabling lateral movement or full container escape scenarios within the LXD cluster.

Remediation Plan

Immediate Action: Upgrade to LXD version 5.0.8, 5.21.6, 6.10, or later versions immediately to apply the necessary authorization checks.

Proactive Monitoring: Review LXD audit logs for suspicious instance migration patterns or unexpected configuration changes in restricted projects.

Compensating Controls: Restrict administrative access to the LXD API to trusted users only, as the vulnerability requires existing authentication to exploit.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the bypass of project-level security boundaries.

Analyst Recommendation

This vulnerability represents a significant breakdown in security policy enforcement within the LXD environment. Organizations should prioritize updating their LXD instances to the identified patched versions to prevent unauthorized configuration overrides and maintain project isolation.

Description Summary:
A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system by providing a malicious archive with a symlinked backup configuration file.

Executive Summary:
A critical link following vulnerability in Canonical LXD allows authenticated attackers to execute arbitrary commands with root privileges on the host system.

Vulnerability Details

CVE-ID: CVE-2026-63294

Affected Software: Canonical LXD

Affected Versions: 4.0.0 up to (excluding) 4.0.12, 5.0.0 up to (excluding) 5.0.8, 5.21.0 up to (excluding) 5.21.6, 6.0 up to (excluding) 6.10

Vulnerability: This is an improper link resolution vulnerability (CWE-59) triggered during the import or unpacking of archives. By using a symlinked backup.yaml file, an attacker forces LXD to process unconfined configuration metadata, leading to arbitrary command execution with root-level privileges.

Business Impact

With a CVSS score of 9.9, this vulnerability poses the highest possible risk to organizational security. Successful exploitation grants the attacker full control over the host system, enabling complete data exfiltration, service disruption, or the deployment of persistent threats within the environment.

Remediation Plan

Immediate Action: Upgrade to LXD version 4.0.12, 5.0.8, 5.12.6, or 6.10 (or later) to address the underlying symlink validation logic.

Proactive Monitoring: Audit logs for unauthorized execution of commands or unusual process spawning during archive operations.

Compensating Controls: Ensure that the LXD daemon is running with the least privilege necessary and isolate the import functionality from untrusted sources.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires authenticated access, the ability to gain root execution makes this a high-priority target for threat actors.

Analyst Recommendation

This vulnerability is critical and requires immediate attention. Security teams must ensure that all LXD environments are updated to the latest patched versions to prevent potential root command execution and total host compromise.

Description Summary:
A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system by providing a crafted image archive with a symlinked metadata file.

Executive Summary:
A critical link following vulnerability in Canonical LXD enables authenticated attackers to perform unauthorized file operations on the host system by exploiting improper symbolic link validation.

Vulnerability Details

CVE-ID: CVE-2026-63293

Affected Software: Canonical LXD

Affected Versions: 4.0.0 up to (excluding) 4.0.12, 5.0.0 up to (excluding) 5.0.8, 5.21.0 up to (excluding) 5.21.6, 6.0 up to (excluding) 6.10

Vulnerability: This is an improper link resolution vulnerability (CWE-59) where the application fails to validate symbolic links during the unpacking of image archives. An authenticated attacker can use this to point the metadata.yaml file to sensitive locations on the host, facilitating arbitrary file reads or writes.

Business Impact

This vulnerability carries a CVSS score of 9.9, reflecting its potential for full host system compromise. By manipulating file access, an attacker could extract sensitive credentials or modify system configuration files, severely impacting the security posture of the entire infrastructure managed by LXD.

Remediation Plan

Immediate Action: Apply the vendor-provided security patches by upgrading to LXD version 4.0.12, 5.0.8, 5.12.6, or 6.10 (or later).

Proactive Monitoring: Monitor host file system integrity and review logs for suspicious activity involving image archive ingestion or unusual file access patterns.

Compensating Controls: Implement strict access control lists for image storage and limit the ability of non-privileged users to trigger image import processes.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires the ability to import malicious archives, which typically restricts the attack vector to users with sufficient authorization.

Analyst Recommendation

Given the critical CVSS rating, immediate remediation is required. Organizations should identify all affected LXD installations and schedule upgrades to the specified patched versions to mitigate the risk of unauthorized host file access.

Description Summary:
An authorization bypass in Canonical LXD allows authenticated attackers to skip project security checks during cross-project migrations by masquerading as internal cluster notifications.

Executive Summary:
Canonical LXD contains a critical authorization flaw that allows authenticated attackers to bypass project security restrictions during cross-project instance migrations.

Vulnerability Details

CVE-ID: CVE-2026-62420

Affected Software: Canonical LXD

Affected Versions: 5.0.0 up to (excluding) 5.0.8, 5.21.0 up to (excluding) 5.21.6, 6.0 up to (excluding) 6.10

Vulnerability: This is an incorrect authorization vulnerability (CWE-863) where the destination node in a cluster incorrectly assumes that incoming migration requests are internal cluster notifications, thereby bypassing all security restriction checks. The attack requires an authenticated user with permission to initiate migrations.

Business Impact

By exploiting this flaw, an attacker can move arbitrary instance configurations into restricted projects, effectively neutralizing the security boundaries of the LXD cluster. Given the CVSS score of 9.9, this allows for total technical impact, including potential privilege escalation and unauthorized access to restricted container resources.

Remediation Plan

Immediate Action: Update all nodes in the LXD cluster to version 5.0.8, 5.21.6, or 6.10 or later to ensure correct authorization validation.

Proactive Monitoring: Review cluster migration traffic and access logs for requests that appear to be bypassing intended project-level security policies.

Compensating Controls: Ensure that the cluster network is isolated and that only authorized nodes can communicate with the LXD API to prevent unauthorized internal-style traffic.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. CISA's SSVC assessment indicates that this is not currently being exploited.

Analyst Recommendation

This vulnerability is critical due to its ability to bypass all project-level security checks during cluster migrations. It is imperative that all cluster members are patched simultaneously to prevent an attacker from targeting unpatched nodes within the cluster.

Description Summary:
Juju contains an authorization flaw in the Controller facade that allows authenticated users to extract sensitive cloud credentials.

Executive Summary:
A critical authorization vulnerability in Juju allows low-privileged authenticated users to access sensitive cloud credentials, leading to potential full infrastructure compromise.

Vulnerability Details

CVE-ID: CVE-2026-5412

Affected Software: Canonical Juju

Affected Versions: Prior to 2.9.57 and 3.6.21

Vulnerability: This is an authorization issue in the Controller facade. An authenticated user can invoke the CloudSpec API method to retrieve highly sensitive cloud bootstrap credentials.

Business Impact

With a CVSS score of 9.9, the impact is severe. An attacker with even low-level access can steal credentials to control the entire underlying cloud environment, leading to massive data breaches and unauthorized manipulation of cloud infrastructure.

Remediation Plan

Immediate Action: Upgrade Juju to versions 2.9.57 or 3.6.21 or later.

Proactive Monitoring: Review Juju controller access logs for unusual calls to the CloudSpec API method by non-privileged accounts.

Compensating Controls: Implement the principle of least privilege for all Juju users and rotate cloud credentials immediately if unauthorized access is suspected.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this credential exposure issue demands an immediate upgrade. Organizations should also rotate any credentials that may have been exposed as a precautionary measure.

Description Summary:
A path traversal vulnerability in Canonical Multipass allows local attackers to access restricted directories.

Executive Summary:
A path traversal vulnerability in Canonical Multipass before version 1.16.3 could allow local attackers to bypass file system restrictions.

Vulnerability Details

CVE-ID: CVE-2026-49238

Affected Software: Canonical Multipass

Affected Versions: 0 up to (excluding) 1.16.3

Vulnerability: This is a Path Traversal (CWE-22) vulnerability requiring local, low-privileged access to the host. An attacker can manipulate pathnames to escape intended directory constraints, potentially leading to unauthorized data access.

Business Impact

While the attack requires local access, the potential for unauthorized access to sensitive files or configuration data is significant. The CVSS score of 8.4 reflects the risk of local privilege escalation or sensitive information disclosure, which could compromise the integrity of the host environment.

Remediation Plan

Immediate Action: Update Canonical Multipass to version 1.16.3 or later to remediate the path traversal flaw.

Proactive Monitoring: Review local system logs for unusual file access activities initiated by low-privileged user accounts.

Compensating Controls: Implement strict file system permissions and ensure that only authorized users have access to the host machine running the Multipass software.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible.

Analyst Recommendation

Administrators should immediately verify their Multipass installation versions and upgrade to 1.16.3. Due to the potential for local privilege escalation, prompt patching is essential for maintaining host security.

Description Summary:
Juju's internal Dqlite database fails to validate TLS certificates, allowing unauthenticated attackers to join the cluster and gain full read/write access to the database.

Executive Summary:
Juju controllers are vulnerable to total data compromise because the internal Dqlite database fails to authenticate new nodes, allowing unauthenticated attackers to gain full database access.

Vulnerability Details

CVE-ID: CVE-2026-4370

Affected Software: Canonical Juju

Affected Versions: 3.2.0 through 3.6.19 and 4.0 through 4.0.4

Vulnerability: The Juju controller's Dqlite database endpoint fails to perform proper TLS client and server authentication. This allows an unauthenticated attacker with network access to the Dqlite port to join the cluster without a valid certificate, bypassing all security checks.

Business Impact

This vulnerability carries a maximum CVSS score of 10.0. An attacker joining the database cluster gains full read and write access to all Juju configuration and state data, leading to total compromise of the managed environment, including secrets and credentials.

Remediation Plan

Immediate Action: Update Juju to the latest patched versions (consult Canonical's advisory for the specific 3.x and 4.x release targets).

Proactive Monitoring: Inspect network traffic for unauthorized connections to the Juju controller's Dqlite port (typically 17017) and audit the Dqlite cluster membership for unknown nodes.

Compensating Controls: Restrict network access to the Juju controller's Dqlite port using firewalls or security groups to allow only known, trusted controller nodes.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 1, 2026, there is no public information indicating active exploitation. However, the lack of authentication on a core database component makes this a prime target for attackers.

Analyst Recommendation

The CVSS score of 10.0 demands immediate remediation. Administrators must patch Juju controllers and strictly enforce network-level access controls to the database ports to prevent unauthorized cluster joining.

Description Summary:
A local privilege escalation vulnerability in snapd allows attackers to gain root access by re-creating private /tmp directories during systemd-tmpfiles cleanup cycles.

Executive Summary:
A local privilege escalation vulnerability in the snapd package on Ubuntu systems allows an attacker to achieve full root compromise, warranting immediate remediation.

Vulnerability Details

CVE-ID: CVE-2026-3888

Affected Software: Canonical snapd

Affected Versions: Versions prior to 2.75.1, including specific patched releases for Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.

Vulnerability: This is a privilege chaining vulnerability (CWE-268) where an unprivileged local user can exploit the interaction between the snap-confine utility and systemd-tmpfiles. By timing the recreation of a specific temporary directory after a cleanup cycle, an attacker can trick the system into binding malicious files with root privileges.

Business Impact

Successful exploitation leads to a total compromise of the host system, granting the attacker full root-level access. This allows for complete data exfiltration, unauthorized system modifications, and persistent backdoors, which poses a severe risk to organizational confidentiality, integrity, and availability. While the CVSS score of 7.8 indicates high severity, the requirement for local access and a specific time-based window for exploitation does not diminish the critical nature of a full root compromise.

Remediation Plan

Immediate Action: Update the snapd package to the latest patched version provided by Canonical using standard package management tools (sudo apt update && sudo apt install --only-upgrade snapd).

Proactive Monitoring: Monitor system logs for unusual execution patterns or unauthorized attempts to access or modify directories within /tmp/snap-private-tmp.

Compensating Controls: Ensure that system configurations for tmpfiles.d are strictly managed and that least-privilege principles are enforced for all local user accounts to limit the potential for initial access.

Exploitation Status

Public Exploit Available: Yes, multiple public proofs-of-concept are available via GitHub repositories.

Analyst Notes: As of March 19, 2026, there is no confirmed active exploitation in the wild; however, the availability of multiple public proof-of-concept repositories means the exploitation risk should be treated as credible. The vulnerability is inherently exploitable by any local user, provided they can wait for the system cleanup cycle to trigger.

Analyst Recommendation

The risk of full root compromise necessitates that all administrators of affected Ubuntu systems apply the provided security patches immediately. While the exploit requires a specific time-based condition, the potential for total system takeover makes this a high-priority update. Ensure that your automated update processes are functioning correctly or perform a manual update to the specified patched versions to mitigate this risk.

Description Summary:
Canonical LXD versions 4.12 through 6.7 contain a privilege escalation vulnerability where restricted TLS certificate users can elevate to cluster admin.

Executive Summary:
A critical privilege escalation vulnerability in Canonical LXD allows authenticated users to gain cluster admin privileges.

Vulnerability Details

CVE-ID: CVE-2026-34179

Affected Software: Canonical LXD

Affected Versions: 4.12 through 6.7

Vulnerability: The doCertificateUpdate function fails to validate the Type field during PUT/PATCH requests to /1.0/certificates/{fingerprint}. This allows a remote authenticated attacker with restricted TLS access to escalate privileges to cluster admin.

Business Impact

With a CVSS score of 9.1, this vulnerability allows an attacker to gain full control over the LXD cluster. This could lead to unauthorized access to all containers, data theft, and the ability to deploy malicious workloads across the cluster.

Remediation Plan

Immediate Action: Update LXD to a version that contains the fix for this privilege escalation vulnerability.

Proactive Monitoring: Monitor API audit logs for unusual certificate update requests or unauthorized administrative actions.

Compensating Controls: Limit access to the LXD API to only trusted, authorized users and implement strict network-level controls for cluster management traffic.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Privilege escalation within container orchestration platforms is a high-priority risk. Administrators must update their LXD installations immediately to ensure that restricted users cannot elevate their privileges and compromise the entire cluster.

Description Summary:
A backup import validation flaw in Canonical LXD allows authenticated remote attackers to bypass project restrictions and achieve full host compromise.

Executive Summary:
An authentication bypass vulnerability in the Canonical LXD backup import process allows an attacker to execute arbitrary configurations, leading to full host compromise.

Vulnerability Details

CVE-ID: CVE-2026-34178

Affected Software: Canonical LXD

Affected Versions: Before 6.8

Vulnerability: The vulnerability exists because the backup import process validates restrictions against the wrong file. An authenticated remote attacker with instance-creation permissions can craft a malicious archive to force privileged execution, bypassing security constraints.

Business Impact

The CVSS score of 9.1 highlights the critical nature of this flaw. By bypassing project restrictions, an attacker can gain full control over the host system, creating significant risk for data confidentiality, integrity, and availability within the affected LXD environment.

Remediation Plan

Immediate Action: Update all instances of Canonical LXD to version 6.8 or later to ensure backup integrity validation is enforced correctly.

Proactive Monitoring: Review logs for suspicious instance creation events or backup imports originating from untrusted or low-privilege users.

Compensating Controls: Implement strict Access Control Lists (ACLs) for users permitted to perform instance creation or backup restoration tasks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should treat this as a high-priority update. The ability for a restricted user to gain full host access via a simple backup import makes this a critical path for remediation to prevent catastrophic system failure.

Description Summary:
An incomplete denylist in Canonical LXD allows a restricted project user to inject AppArmor and QEMU configurations, facilitating privilege escalation to host root.

Executive Summary:
A critical vulnerability in Canonical LXD allows an attacker with restricted VM permissions to escape the sandbox and achieve full host root privileges.

Vulnerability Details

CVE-ID: CVE-2026-34177

Affected Software: Canonical LXD

Affected Versions: 4.12 through 6.7

Vulnerability: The vulnerability resides in the isVMLowLevelOptionForbidden function, which fails to correctly block raw.apparmor and raw.qemu.conf keys. An authenticated attacker with can_edit permissions can leverage this to bridge the LXD Unix socket and escalate privileges.

Business Impact

With a CVSS score of 9.1, this flaw represents a major security failure in multi-tenant environments. An attacker gaining host root access effectively compromises the entire hypervisor and all containers or VMs managed by the cluster, leading to total data loss and system-wide compromise.

Remediation Plan

Immediate Action: Upgrade Canonical LXD to the latest version to ensure the restricted project denylist is properly enforced.

Proactive Monitoring: Audit LXD project configurations for unauthorized usage of raw.apparmor or raw.qemu.conf keys.

Compensating Controls: Restrict the can_edit permission to only highly trusted administrators until the patch can be applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability poses a severe risk to containerized and virtualized environments. Administrators must audit their current LXD configurations for signs of tampering and apply the vendor-provided patch immediately to prevent unauthorized host-level access.

Description Summary:
A flaw in Juju versions 3.0.0 through 3.6.18 allows authenticated grantees to improperly modify or access secrets due to incorrect authorization checks in the secret-set tool.

Executive Summary:
A high severity authorization vulnerability in Canonical Juju allows authenticated users to gain unauthorized access to or modify system secrets.

Vulnerability Details

CVE-ID: CVE-2026-32693

Affected Software: Canonical Juju

Affected Versions: 3.0.0 up to (excluding) 3.6.19

Vulnerability: The vulnerability involves incorrect authorization in the secret-set tool, which permits an authenticated grantee to update secret content beyond their intended permissions. This flaw allows unauthorized reading or modification of secrets, even when error logs indicate a failed operation.

Business Impact

The ability for unauthorized users to access or manipulate secrets poses a significant risk to the integrity and confidentiality of the entire managed environment. Because Juju manages secrets for distributed applications, this compromise could lead to lateral movement, credential theft, or the disruption of critical services. With a CVSS score of 8.8, this vulnerability is categorized as high severity and requires immediate attention to prevent unauthorized data exposure.

Remediation Plan

Immediate Action: Upgrade Canonical Juju to version 3.6.19 or the latest available release containing the fix provided by the vendor.

Proactive Monitoring: Review Juju access logs for unusual activity involving the secret-set tool or unexpected modifications to secret values by non-owner accounts.

Compensating Controls: Implement strict identity and access management policies to limit the number of users with grantee access to sensitive secrets until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous because it bypasses standard authorization logic, granting attackers control over sensitive configuration data.

Analyst Recommendation

Given the potential for full secret compromise, organizations should prioritize upgrading their Juju installations immediately. Ensure all administrative teams are aware of the flaw and verify that secret access permissions are audited following the update to confirm no unauthorized changes occurred during the vulnerable period.

Description Summary:
A flaw in the Vault secrets back-end of Canonical Juju allows an authenticated unit agent to perform unauthorized updates to secret revisions, potentially poisoning existing secrets.

Executive Summary:
An authorization bypass vulnerability in Canonical Juju allows authenticated unit agents to poison secret revisions, posing a significant risk to sensitive data integrity.

Vulnerability Details

CVE-ID: CVE-2026-32692

Affected Software: Canonical Juju

Affected Versions: 3.1.6 up to (excluding) 3.6.19

Vulnerability: This is an improper authorization vulnerability (CWE-285) within the Vault secrets back-end implementation. It allows an already authenticated unit agent to modify secret revisions beyond their intended scope.

Business Impact

Successful exploitation of this vulnerability permits an attacker to poison existing secrets, which could lead to unauthorized data access, service disruption, or the compromise of downstream systems relying on those secrets. With a CVSS score of 7.6, the vulnerability is classified as High severity, reflecting the potential for significant impact on the confidentiality and integrity of the secret management infrastructure.

Remediation Plan

Immediate Action: Update Canonical Juju to the patched version identified in the upstream fix, specifically the commit version 0.0.0-20260319091847-d06919eb03ec.

Proactive Monitoring: Review Juju access logs for unusual unit agent activity or unauthorized attempts to modify secret revisions.

Compensating Controls: Ensure strict adherence to the principle of least privilege for unit agents and implement auditing on all secret management operations to detect unauthorized changes.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires the attacker to have already compromised or authenticated as a unit agent, limiting the initial attack vector to those who have already established a foothold within the Juju environment.

Analyst Recommendation

Given the High severity of this authorization bypass, administrators should prioritize updating Juju instances to the latest secure version. Immediate remediation is necessary to prevent potential secret poisoning and ensure the continued integrity of vault-managed credentials within the infrastructure.

Description Summary:
A broken access control vulnerability in the devLXDInstancePatchHandler component of Canonical LXD allows unauthorized storage volume access between guests.

Executive Summary:
Canonical LXD is affected by a broken access control vulnerability that permits untrusted guests to read or overwrite the storage volumes of other instances.

Vulnerability Details

CVE-ID: CVE-2026-12411

Affected Software: Canonical LXD

Affected Versions: See vendor advisory

Vulnerability: The flaw exists in the devLXDInstancePatchHandler component, which improperly validates device PATCH requests. An untrusted guest can exploit this to mount and manipulate custom storage volumes belonging to other guests, effectively breaking the isolation boundaries of the LXD container environment.

Business Impact

The CVSS score of 8.4 highlights the severity of this privilege escalation and cross-container compromise. This vulnerability allows for significant data exposure and integrity loss, as an attacker could potentially modify or steal sensitive data across container boundaries, threatening the entire multi-tenant infrastructure.

Remediation Plan

Immediate Action: Apply all security patches released by Canonical for the LXD package immediately.

Proactive Monitoring: Review LXD audit logs for suspicious or unauthorized device PATCH requests or unexpected volume mounting activities.

Compensating Controls: Where possible, isolate highly sensitive workloads on separate physical hosts to provide an additional layer of security beyond container isolation.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for cross-container data access, this vulnerability must be treated with high urgency in multi-tenant or shared-hosting environments. Administrators should audit their LXD configurations and apply the necessary patches as soon as they become available.

Description Summary:
An unspecified vulnerability exists in Canonical ADSys upstream versions through v0, requiring immediate review of vendor security disclosures.

Executive Summary:
A high-severity vulnerability has been identified in the Canonical ADSys utility, necessitating immediate attention from system administrators to prevent potential security compromise.

Vulnerability Details

CVE-ID: CVE-2026-12249

Affected Software: Canonical ADSys

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a security issue found in the Canonical ADSys upstream code. Technical details regarding the exploit vector are currently limited, and administrators should consult the vendor's official security bulletin for the specific scope of the flaw.

Business Impact

As a component often involved in Active Directory integration and system management, a vulnerability in ADSys could lead to unauthorized system configuration changes or privilege escalation. With a CVSS score of 8.3, this issue is classified as high-severity and warrants immediate remediation to protect the integrity of managed Ubuntu environments.

Remediation Plan

Immediate Action: Consult the Canonical security advisory and apply all available patches for ADSys immediately.

Proactive Monitoring: Monitor system logs for unusual authentication patterns or unexpected configuration changes on machines utilizing ADSys.

Compensating Controls: Restrict access to configuration management interfaces and ensure that administrative accounts are highly protected until the patch is verified.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should treat this high-severity advisory with urgency. Canonical frequently updates their security notices; ensure that your patch management systems are configured to pull the latest security updates for ADSys to mitigate this risk.

Description Summary:
A sandbox escape vulnerability in Ubuntu's OpenJDK packages allows arbitrary code execution outside the sandbox when the mailcap package is installed.

Executive Summary:
A high-severity sandbox escape vulnerability exists in Canonical Ubuntu OpenJDK packages that allows local attackers to execute arbitrary code outside of the intended sandbox environment.

Vulnerability Details

CVE-ID: CVE-2026-10037

Affected Software: Canonical Ubuntu

Affected Versions: Ubuntu 26.04 LTS resolute prior to mailcap 3.75ubuntu1.1, Ubuntu 25.10 questing prior to mailcap 3.74ubuntu1.1, Ubuntu 24.04 LTS noble prior to mailcap 3.70+nmu1ubuntu1.24.04.1, and Ubuntu 22.04 LTS jammy prior to mailcap 3.70+nmu1ubuntu1.22.04.1.

Vulnerability: This vulnerability occurs because .jar MIME handlers execute files marked as executable when the mailcap package is present. This flaw allows a compromised application running within a sandbox to bypass security controls and execute arbitrary code on the underlying host system.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a significant risk to system integrity and confidentiality. Successful exploitation permits an attacker to escape containerized or sandboxed environments, potentially leading to full system compromise, unauthorized data access, and lateral movement within the network.

Remediation Plan

Immediate Action: Update the mailcap package to the patched versions: 3.75ubuntu1.1, 3.74ubuntu1.1, 3.70+nmu1ubuntu1.24.04.1, or 3.70+nmu1ubuntu1.22.04.1 depending on your Ubuntu release.

Proactive Monitoring: Review system access logs for anomalous process execution patterns originating from sandboxed Java applications.

Compensating Controls: If patching is delayed, restrict the use of MIME handlers for .jar files and limit the execution permissions of untrusted applications within the environment.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this sandbox escape necessitates immediate action. Administrators should prioritize the deployment of the specified mailcap security updates across all affected Ubuntu instances to prevent potential host-level compromise.

Description Summary:
A path traversal vulnerability in the Juju controller /charms endpoint allows authenticated users to upload malicious charms, potentially leading to unauthorized machine access via Zip Slip.

Executive Summary:
A critical path traversal vulnerability in Canonical Juju allows authenticated users to achieve remote code execution on units by uploading malicious charms.

Vulnerability Details

CVE-ID: CVE-2025-53513

Affected Software: Canonical Juju

Affected Versions: 2.0.0 up to 2.9.52, 3.0.0 up to 3.6.8

Vulnerability: The /charms endpoint lacks proper authorization and input validation, permitting an authenticated user to perform a path traversal attack. By uploading a crafted charm that exploits a Zip Slip vulnerability, an attacker can overwrite files and gain unauthorized access to machines running the affected unit.

Business Impact

This vulnerability poses a significant risk to infrastructure integrity, as it allows any authenticated user to escalate privileges and execute code on target machines. Given the CVSS score of 8.8, this flaw represents a high risk for environments relying on Juju for service orchestration, potentially resulting in full system compromise and lateral movement within the containerized or cloud environment.

Remediation Plan

Immediate Action: Upgrade Juju to the patched versions provided by Canonical or the specific Go module version 0.0.0-20250619215741-6356e984b82a to remediate the endpoint flaw.

Proactive Monitoring: Review Juju controller access logs for unauthorized or suspicious charm uploads, particularly those originating from accounts that do not typically perform administrative or deployment tasks.

Compensating Controls: Implement strict Role Based Access Control (RBAC) to limit the number of users capable of uploading charms to the controller until patches are verified and applied.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 9, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The combination of path traversal and Zip Slip makes this a potent vector for attackers to escape intended boundaries.

Analyst Recommendation

The risk associated with this vulnerability is high due to the potential for remote code execution. Security teams should prioritize patching the Juju controller immediately and restricting upload permissions to essential personnel only. Failure to address this flaw could lead to a total compromise of managed units within the Juju environment.

Description Summary:
Juju contains an improper authorization flaw allowing authenticated users to upload arbitrary agent binaries, potentially leading to remote code execution.

Executive Summary:
Canonical Juju is affected by an authorization bypass vulnerability that allows authenticated users to execute arbitrary code on controller or model machines.

Vulnerability Details

CVE-ID: CVE-2025-0928

Affected Software: Canonical Juju

Affected Versions: 2.0.0 up to (excluding) 2.9.52, 3.0.0 up to (excluding) 3.6.8

Vulnerability: The vulnerability is an improper authorization flaw (CWE-285) where an authenticated controller user can upload arbitrary agent binaries without verifying model membership or required permissions. This allows for the distribution of malicious binaries to machines during upgrade or deployment cycles.

Business Impact

Successful exploitation allows an authenticated attacker to achieve remote code execution on the Juju controller or managed models. Given the CVSS score of 8.8, this represents a high risk to infrastructure integrity and confidentiality. Compromise of the Juju controller grants the attacker significant control over the cloud environment and orchestrated services, potentially leading to a total system takeover.

Remediation Plan

Immediate Action: Update all Juju installations to version 2.9.52, 3.6.8, or the latest available patched release provided by Canonical.

Proactive Monitoring: Review audit logs for unauthorized binary uploads or unexpected modifications to agent deployment configurations. Monitor controller logs for unusual authentication patterns originating from standard user accounts.

Compensating Controls: Restrict access to the Juju controller API to trusted internal networks only. Implement strict role-based access control to limit which users have permission to manage models or perform administrative tasks.

Exploitation Status

Public Exploit Available: exploit_available (unknown)

Analyst Notes: As of July 9, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the ability to inject arbitrary code into the orchestration lifecycle.

Analyst Recommendation

This vulnerability presents a significant risk to the security of orchestrated environments managed by Juju. Administrators should prioritize the application of security patches to all affected controller instances immediately. Failure to update may allow an authenticated user to escalate privileges and gain unauthorized control over the entire managed infrastructure.

Description Summary:
A flaw in Canonical MAAS allows unauthenticated attackers to bypass authentication and execute RPC commands on a region controller.

Executive Summary:
A critical authentication bypass vulnerability in Canonical MAAS allows unauthenticated remote attackers to execute arbitrary RPC commands, posing a severe risk to infrastructure control.

Vulnerability Details

CVE-ID: CVE-2024-6107

Affected Software: Canonical MAAS

Affected Versions: Canonical MAAS: 3.1.0 up to (excluding) 3.1.4, 3.2.0 up to (excluding) 3.2.11, 3.3.0 up to (excluding) 3.3.8, 3.4.0 up to (excluding) 3.4.4, 3.5.0 up to (excluding) 3.5.1

Vulnerability: The vulnerability is an authentication bypass (CWE-287) caused by insufficient verification of identity claims. An unauthenticated attacker can leverage a malicious client to execute RPC commands within a target region.

Business Impact

Successful exploitation of this vulnerability permits unauthorized command execution, which can lead to full compromise of the affected region controller. Given the CVSS score of 9.6, this represents a critical risk that could result in complete data exfiltration, loss of system integrity, and significant operational disruption.

Remediation Plan

Immediate Action: Upgrade all instances of Canonical MAAS to the patched versions specified in the vendor advisory or the latest available snap release.

Proactive Monitoring: Audit system logs for unexpected RPC activity or unauthorized connection attempts originating from untrusted client addresses.

Compensating Controls: Ensure that the MAAS region controller is not exposed to the public internet and is restricted to trusted management networks via firewall rules.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the lack of required authentication for command execution.

Analyst Recommendation

This vulnerability carries a critical severity rating due to the ability for unauthenticated actors to interact with sensitive RPC functions. Administrators must prioritize the deployment of the provided security updates immediately to protect the integrity of the MAAS environment and prevent unauthorized infrastructure control.