CVE-2026-97335

Name of the Vulnerable Software and Affected Versions Canonical LXD versions 5.0.0 through 5.0.9 Canonical LXD versions 5.1.0 through 5.21.7 Canonical LXD versions 6.0.0 through 6.9.9

Description Incorrect authorization in the custom storage volume creation endpoint allows an authenticated client with permission to create custom volumes in a project to copy and read any custom storage volume from any other project on the server, including its configuration and snapshots. This is achieved by sending a crafted request to the endpoint that specifies a source volume and the source.project variable but omits the source.type variable.

Recommendations Update to version 5.0.10 Update to version 5.21.8 Update to version 6.10