PatchTheCVElxd vulnerabilities and fixes
Recent CVEs affecting lxd, with upgrade or downgrade steps. 13 tracked.
lxd has 13 tracked vulnerabilities, 10 critical. A fixed release or vendor patch exists for 13. Most recent: 2026-08-24. Highest priority: CVE-2026-63294 (score 54/100).
- CVE-2026-66897 CRITICAL 9.9 UPGRADE A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit pe
- CVE-2025-54289 HIGH 8.1 UPGRADE Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read p
- CVE-2026-63294 CRITICAL 9.9 UPGRADE A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system
- CVE-2026-63298 CRITICAL 9.9 UPGRADE An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling a
- CVE-2026-63293 CRITICAL 9.9 UPGRADE A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations o
- CVE-2026-63299 CRITICAL 9.9 UPGRADE An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and vol
- CVE-2026-66898 CRITICAL 9.9 UPGRADE A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import
- CVE-2026-62420 CRITICAL 9.9 UPGRADE An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project securit
- CVE-2026-63300 CRITICAL 9.9 UPGRADE An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allo
- CVE-2026-63296 CRITICAL 9.9 UPGRADE An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restric
- CVE-2026-63297 CRITICAL 9.9 UPGRADE An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authe
- CVE-2026-16033 HIGH 8.5 UPGRADE A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained
- CVE-2026-63295 MEDIUM 4.3 UPGRADE An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level containe
FAQ
How do I fix lxd vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is lxd being exploited right now?
None of the tracked lxd CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which lxd CVE should I patch first?
CVE-2026-63294 currently ranks highest (54/100): A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system.