Register | Log in

lxd

Choose email to subscribe with

general

source: lxd (main)
version: 5.0.2+git20231211.1364ae4-9+deb13u7
maintainer: Debian Go Packaging Team (DMD)
uploaders: Mathias Gibbens [DMD]
arch: all any
std-ver: 4.7.2
VCS: Git (Browse)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

oldstable: 5.0.2-5+deb12u6
old-sec: 5.0.2-5+deb12u6
stable: 5.0.2+git20231211.1364ae4-9+deb13u7
stable-sec: 5.0.2+git20231211.1364ae4-9+deb13u7

versioned links

5.0.2-5+deb12u6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.0.2+git20231211.1364ae4-9+deb13u7: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

golang-github-canonical-lxd-dev
lxd
lxd-agent
lxd-client
lxd-migrate
lxd-tools

package is gone

This package is not in any development repository. This probably means that the package has been removed (or has been renamed). Thus the information here is of little interest ... the package is going to disappear unless someone takes it over and reintroduces it.

action needed

Debci reports failed tests high

unstable: fail (log)
The tests ran in 0:00:22
Last run: 2025-08-27T01:32:05.000Z
Previous status: unknown

testing: pass (log)
The tests ran in 0:03:03
Last run: 2025-08-01T01:31:38.000Z
Previous status: unknown

stable: pass (log)
The tests ran in 0:03:39
Last run: 2026-09-29T08:48:02.000Z
Previous status: unknown

Created: 2025-08-27 Last update: 2026-10-04 14:00

23 security issues in trixie high

There are 23 open security issues in trixie.

19 important issues:

CVE-2026-16033: A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory (specifically affecting virtual machine / QEMU driver execution paths). An attacker can exploit this flaw by providing a crafted image archive with malicious template directives containing path traversal sequences, causing LXD to access or write files outside the intended template directory on the host system.
CVE-2026-62420: An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/{name} with migration: true, project: <target>, and target: <member>, the destination node skips all project restriction checks because the request arrives as an internal cluster notification. An attacker can exploit this to introduce disallowed instance configurations into a restricted project.
CVE-2026-63293: A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a crafted image archive with a symlinked metadata.yaml file pointing to target file paths on the host system.
CVE-2026-63294: A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can exploit this flaw by providing a malicious archive with a symlinked backup.yaml file, causing LXD to process unconfined configuration metadata and execute arbitrary commands with root privileges.
CVE-2026-63295: An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges (such as enforcing restricted.containers.privilege=isolated), LXD fails to enforce the requirement if an instance configuration omits the security.idmap.isolated key. An attacker can exploit this flaw by creating or updating an instance without explicitly setting security.idmap.isolated, bypassing the target project's security constraints.
CVE-2026-63296: An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without validating the new configuration against the target project's enforced restrictions. An attacker can exploit this flaw to move instances with disallowed high-privilege configurations into restricted projects, bypassing security controls.
CVE-2026-63297: An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction checks before configuration merging is complete, creating a time-of-check to time-of-use (TOCTOU) condition. An attacker can exploit this flaw to copy instances with disallowed high-privilege configurations into restricted projects, bypassing security controls.
CVE-2026-63298: An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration values, an attacker can manipulate the generated lxc.conf file. This flaw enables the attacker to execute arbitrary code on the host system with the privileges of the LXD daemon.
CVE-2026-63299: An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil (Config == nil). An attacker can exploit these flaws to allocate storage resources that exceed the administrative limits configured for a project.
CVE-2026-63300: An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker with can_create_instances permissions on a restricted project to bypass project-level security restrictions. When migrating an instance between projects, LXD fails to validate the instance's configuration against the target project's enforced restrictions (such as restricted.containers.lowlevel, restricted.devices.*, and restricted.networks.access). An attacker can exploit this by creating a disallowed or high-privilege instance in an unrestricted project and subsequently moving it into the restricted project.
CVE-2026-66897: A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates the path against a confined os.Root directory handle but subsequently opens and creates the file using os.Create with an unconfined string path. This discrepancy between path resolution checks and file creation allows an attacker to escape directory confinement, overwrite root-owned host files, and achieve host root code execution.
CVE-2026-66898: A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploit this flaw by supplying a crafted backup archive with malicious instance or volume names containing path traversal sequences, potentially allowing file access or overwriting outside the designated restore directory.
CVE-2026-85185: Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is btrfs, the client can also place attacker-controlled content at arbitrary host paths, leading to full host compromise. The client does this with a crafted subvolume path containing ../ sequences, sent in either of two ways: in the optimized_header.yaml of an optimized btrfs backup, or in the btrfs migration header sent by a malicious migration source.
CVE-2026-85526: Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root via a crafted subvolumes[].path entry in backup/optimized_header.yaml during a btrfs optimized backup import.
CVE-2026-86334: Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote malicious or machine-in-the-middle image server to overwrite arbitrary local files and execute code on the client system via a crafted Content-Disposition header filename parameter during unified image export or copy operations into a local directory target.
CVE-2026-86335: Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests.
CVE-2026-87798: Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 (fixed in 4.0.14, 5.0.10 and 5.21.8) on Linux allows an attacker with root access inside a virtual machine to write attacker-controlled files or directory trees to arbitrary paths on the client host, with the operator's privileges. The attacker does this by using a modified lxd-agent that returns inconsistent SFTP directory listings and Lstat results.
CVE-2026-87799: Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client that can create instances or custom storage volumes in a project, or a malicious migration source server, to write attacker-controlled files to arbitrary paths on the target host as root, leading to full host compromise. The attacker does this with a crafted rsync or btrfs send stream that plants a symlink in the transferred volume, such as rootfs or root.img, and then writes through it.
CVE-2026-97335: Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed in 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create custom volumes in a project to copy, and so read, any custom storage volume from any other project on the server, including its snapshots and configuration. The client does this with a crafted request that sets a source volume and source.project but omits source.type.

4 ignored issues:

CVE-2024-6156: Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store.
CVE-2025-54289: Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format
CVE-2025-54290: Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints.
CVE-2025-54291: Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.

Created: 2025-08-09 Last update: 2026-10-04 01:32

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2024-6156: Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store.

Created: 2025-08-09 Last update: 2025-08-13 17:04

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2024-6156: Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store.

Created: 2024-12-06 Last update: 2025-08-10 06:32

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2026-09-02 Last update: 2026-10-04 13:30

news

[2026-06-30] Accepted lxd 5.0.2+git20231211.1364ae4-9+deb13u7 (source) into proposed-updates (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-06-28] Accepted lxd 5.0.2+git20231211.1364ae4-9+deb13u7 (source) into stable-security (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-05-04] Accepted lxd 5.0.2+git20231211.1364ae4-9+deb13u6 (source) into proposed-updates (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-05-04] Accepted lxd 5.0.2-5+deb12u6 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-05-04] Accepted lxd 5.0.2+git20231211.1364ae4-9+deb13u6 (source) into stable-security (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-05-04] Accepted lxd 5.0.2-5+deb12u6 (source) into oldstable-security (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-04-18] Accepted lxd 5.0.2-5+deb12u5 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-04-18] Accepted lxd 5.0.2+git20231211.1364ae4-9+deb13u5 (source) into proposed-updates (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-04-15] Accepted lxd 5.0.2+git20231211.1364ae4-9+deb13u5 (source) into stable-security (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-04-15] Accepted lxd 5.0.2-5+deb12u5 (source) into oldstable-security (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-04-02] Accepted lxd 5.0.2+git20231211.1364ae4-9+deb13u4 (source) into proposed-updates (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-04-02] Accepted lxd 5.0.2-5+deb12u4 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-03-31] Accepted lxd 5.0.2+git20231211.1364ae4-9+deb13u4 (source) into stable-security (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-03-31] Accepted lxd 5.0.2-5+deb12u4 (source) into oldstable-security (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-03-13] Accepted lxd 5.0.2-5+deb12u3 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-03-01] Accepted lxd 5.0.2+git20231211.1364ae4-9+deb13u3 (source) into proposed-updates (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-03-01] Accepted lxd 5.0.2+git20231211.1364ae4-9+deb13u3 (source) into stable-security (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-03-01] Accepted lxd 5.0.2-5+deb12u3 (source) into oldstable-security (Debian FTP Masters) (signed by: Mathias Gibbens)
[2025-12-07] Accepted lxd 5.0.2+git20231211.1364ae4-9+deb13u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Mathias Gibbens)
[2025-11-14] Accepted lxd 5.0.2-5+deb12u2 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Mathias Gibbens)
[2025-11-13] Accepted lxd 5.0.2-5+deb12u2 (source) into oldstable-security (Debian FTP Masters) (signed by: Mathias Gibbens)
[2025-10-19] Accepted lxd 5.0.2-5+deb12u1 (source amd64) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Mathias Gibbens)
[2025-10-19] Accepted lxd 5.0.2+git20231211.1364ae4-9+deb13u1 (source all amd64) into proposed-updates (Debian FTP Masters) (signed by: Mathias Gibbens)
[2025-10-17] Accepted lxd 5.0.2-5+deb12u1 (source amd64) into oldstable-security (Debian FTP Masters) (signed by: Mathias Gibbens)
[2025-10-17] Accepted lxd 5.0.2+git20231211.1364ae4-9+deb13u1 (source all amd64) into stable-security (Debian FTP Masters) (signed by: Mathias Gibbens)
[2025-08-14] lxd REMOVED from testing (Debian testing watch)
[2025-05-08] lxd 5.0.2+git20231211.1364ae4-9 MIGRATED to testing (Debian testing watch)
[2025-04-27] Accepted lxd 5.0.2+git20231211.1364ae4-9 (source) into unstable (Mathias Gibbens)
[2025-03-01] lxd 5.0.2+git20231211.1364ae4-8 MIGRATED to testing (Debian testing watch)
[2025-02-23] Accepted lxd 5.0.2+git20231211.1364ae4-8 (source) into unstable (Mathias Gibbens)

1
2

bugs [bug history graph]

all: 1
RC: 0
I&N: 1
M&W: 0
F&P: 0
patch: 1

links

homepage
buildd: logs, cross
popcon
browse source code
other distros
security tracker
debci

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing