Improper access control in LXD - CVE-2026-55622
Published: June 29, 2026
Vulnerability identifier: #VU135796
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-55622
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in instance copy handling in POST /1.0/instances when copying an instance across projects. A remote user can send a crafted instance copy request referencing a source project and instance they are not authorized to view to disclose sensitive information.
Exploitation requires knowledge of the source project name and source instance name, and the copy occurs on the same server.
Affected software
LXD
Debian Linux
lxd (Debian package)
Debian Linux
lxd (Debian package)
How to mitigate CVE-2026-55622
Install security update from vendor's website.
LXD - addressed in versions 5.0.7, 5.21.5, 6.8
lxd (Debian package) - update to 5.0.2+git20231211.1364ae4-9+deb13u7
lxd (Debian package) - update to 5.0.2+git20231211.1364ae4-9+deb13u7