Vulnerability in github.com/canonical/lxd (CVE-2026-34177)
Summary
Vulnerability in github.com/canonical/lxd (CVE-2026-34177). Successful exploitation can lead to full system takeover. Exploitable via isVMLowLevelOptionForbidden.
Original description
The description as published by the source.
Summary
The isVMLowLevelOptionForbidden function in lxd/project/limits/permissions.go is missing raw.apparmor and raw.qemu.conf from its hardcoded forbidden list. A user with can_edit permission on a VM instance in a restricted project can combine these two omissions to bridge the LXD unix socket into the guest VM and gain full cluster administrator access. This bypasses the restricted.virtual-machines.lowlevel=block project restriction, which is the security control specifically designed to prevent raw config injection.
Details
Affected code
The enforcement point for VM lowlevel restrictions is isVMLowLevelOptionForbidden at lxd/project/limits/permissions.go:924-926:
func isVMLowLevelOptionForbidden(key string) bool {
return slices.Contains([]string{"boot.host_shutdown_timeout", "limits.memory.hugepages", "raw.idmap", "raw.qemu"}, key)
}
This list is missing two security-critical config keys:
raw.apparmor-- allows injecting arbitrary AppArmor rules into the QEMU process confinement profileraw.qemu.conf-- allows injecting arbitrary sections into the QEMU configuration file
The container equivalent (isContainerLowLevelOptionForbidden at line 916) correctly includes raw.apparmor in its forbidden list.
Attack mechanism
Both raw.apparmor and raw.qemu.conf are valid VM config keys (defined in lxd/instance/instancetype/instance.go). When a restricted user sets them on a VM in a project with `restrict…
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-34177 has been found in github.com/canonical/lxd.
Attackers can target a specific entry point like isVMLowLevelOptionForbidden over the network to misuse the product.
Successful exploitation can lead to full system takeover.
What to do: apply the vendor's official patched release.
If unsure, ask your IT team or search "github.com/canonical/lxd CVE-2026-34177" on the vendor's site.
CVE-2026-34177 (github.com/canonical/lxd) — CWE-184
Attack vector: remote (network-reachable) / no user interaction
Attack surface: isVMLowLevelOptionForbidden / raw.apparmor / raw.qemu.conf / can_edit
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-184) exists in github.com/canonical/lxd. Attackers reach the vulnerable code path via isVMLowLevelOptionForbidden.
Check the vendor advisory for the affected versions of github.com/canonical/lxd. Attack surface: isVMLowLevelOptionForbidden / raw.apparmor / raw.qemu.conf / can_edit.
Severity: ?. Successful exploitation can lead to full system takeover.
Update to the patched release per vendor advisory.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'github.com/canonical/lxd' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'github.com/canonical/lxd' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
github.com/canonical/lxdを grep し、稼働しているサービス・バージョンを把握する。 -
2Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-34177 incus Fixed in: 6.0.2-1
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com