Privilege Escalation Vulnerability in Canonical LXD Virtual Machine Instances

CVE-2026-34177

What is CVE-2026-34177?

The affected versions of Canonical LXD have an operation flaw that allows a remote attacker with editing permissions to inject unauthorized AppArmor rules and QEMU character device configurations. By exploiting this flaw, attackers can gain elevated privileges, potentially escalating to LXD cluster administrator access and even compromising the host system's root access. The incomplete denylist in the system's permissions poses a significant risk to the integrity and security of the virtual machine environments.

References