CVE-2026-12411

PoC —

CVSS 3.1

9.6 critical

EPSS

<1%p21

Published

Jun 26, 2026 (Jun 26, 2026)

Modified

Jul 2, 2026

Description

Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.

Vendors: canonical
Products: lxd
Weakness: CWE-639, CWE-862
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.