Register | Log in

lxd

Choose email to subscribe with

general

source: lxd (main)
version: 5.0.2+git20231211.1364ae4-9+deb13u7
maintainer: Debian Go Packaging Team (DMD)
uploaders: Mathias Gibbens [DMD]
arch: all any
std-ver: 4.7.2
VCS: Git (Browse)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

oldstable: 5.0.2-5+deb12u6
old-sec: 5.0.2-5+deb12u6
stable: 5.0.2+git20231211.1364ae4-9+deb13u7
stable-sec: 5.0.2+git20231211.1364ae4-9+deb13u7

versioned links

5.0.2-5+deb12u6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.0.2+git20231211.1364ae4-9+deb13u7: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

golang-github-canonical-lxd-dev
lxd
lxd-agent
lxd-client
lxd-migrate
lxd-tools

package is gone

This package is not in any development repository. This probably means that the package has been removed (or has been renamed). Thus the information here is of little interest ... the package is going to disappear unless someone takes it over and reintroduces it.

action needed

Debci reports failed tests high

unstable: fail (log)
The tests ran in 0:00:22
Last run: 2025-08-27T01:32:05.000Z
Previous status: unknown

testing: pass (log)
The tests ran in 0:03:03
Last run: 2025-08-01T01:31:38.000Z
Previous status: unknown

stable: pass (log)
The tests ran in 0:03:52
Last run: 2026-08-17T21:13:17.000Z
Previous status: unknown

Created: 2025-08-27 Last update: 2026-08-24 03:30

16 security issues in trixie high

There are 16 open security issues in trixie.

11 important issues:

CVE-2026-16033: A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory (specifically affecting virtual machine / QEMU driver execution paths). An attacker can exploit this flaw by providing a crafted image archive with malicious template directives containing path traversal sequences, causing LXD to access or write files outside the intended template directory on the host system.
CVE-2026-62420: An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/{name} with migration: true, project: <target>, and target: <member>, the destination node skips all project restriction checks because the request arrives as an internal cluster notification. An attacker can exploit this to introduce disallowed instance configurations into a restricted project.
CVE-2026-63293: A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a crafted image archive with a symlinked metadata.yaml file pointing to target file paths on the host system.
CVE-2026-63294: A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can exploit this flaw by providing a malicious archive with a symlinked backup.yaml file, causing LXD to process unconfined configuration metadata and execute arbitrary commands with root privileges.
CVE-2026-63295: An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges (such as enforcing restricted.containers.privilege=isolated), LXD fails to enforce the requirement if an instance configuration omits the security.idmap.isolated key. An attacker can exploit this flaw by creating or updating an instance without explicitly setting security.idmap.isolated, bypassing the target project's security constraints.
CVE-2026-63296: An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without validating the new configuration against the target project's enforced restrictions. An attacker can exploit this flaw to move instances with disallowed high-privilege configurations into restricted projects, bypassing security controls.
CVE-2026-63297: An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction checks before configuration merging is complete, creating a time-of-check to time-of-use (TOCTOU) condition. An attacker can exploit this flaw to copy instances with disallowed high-privilege configurations into restricted projects, bypassing security controls.
CVE-2026-63298: An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration values, an attacker can manipulate the generated lxc.conf file. This flaw enables the attacker to execute arbitrary code on the host system with the privileges of the LXD daemon.
CVE-2026-63299: An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil (Config == nil). An attacker can exploit these flaws to allocate storage resources that exceed the administrative limits configured for a project.
CVE-2026-63300: An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker with can_create_instances permissions on a restricted project to bypass project-level security restrictions. When migrating an instance between projects, LXD fails to validate the instance's configuration against the target project's enforced restrictions (such as restricted.containers.lowlevel, restricted.devices.*, and restricted.networks.access). An attacker can exploit this by creating a disallowed or high-privilege instance in an unrestricted project and subsequently moving it into the restricted project.
CVE-2026-66898: A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploit this flaw by supplying a crafted backup archive with malicious instance or volume names containing path traversal sequences, potentially allowing file access or overwriting outside the designated restore directory.

1 issue left for the package maintainer to handle:

CVE-2026-28385: (postponed; to be fixed through a stable update) In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users with the can_create_images entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a URL source, the LXD daemon fails to validate or restrict outbound destination IP addresses, allowing connections to loopback, RFC1918 private ranges, and cloud metadata endpoints. This enables error-based port scanning and unauthorized interaction with internal HTTP services from the daemon's network position.

You can find information about how to handle this issue in the security team's documentation.

4 ignored issues:

CVE-2024-6156: Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store.
CVE-2025-54289: Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format
CVE-2025-54290: Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints.
CVE-2025-54291: Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.

Created: 2025-08-09 Last update: 2026-08-22 04:50

15 security issues in bookworm high

There are 15 open security issues in bookworm.

11 important issues:

CVE-2026-16033: A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory (specifically affecting virtual machine / QEMU driver execution paths). An attacker can exploit this flaw by providing a crafted image archive with malicious template directives containing path traversal sequences, causing LXD to access or write files outside the intended template directory on the host system.
CVE-2026-62420: An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/{name} with migration: true, project: <target>, and target: <member>, the destination node skips all project restriction checks because the request arrives as an internal cluster notification. An attacker can exploit this to introduce disallowed instance configurations into a restricted project.
CVE-2026-63293: A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a crafted image archive with a symlinked metadata.yaml file pointing to target file paths on the host system.
CVE-2026-63294: A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can exploit this flaw by providing a malicious archive with a symlinked backup.yaml file, causing LXD to process unconfined configuration metadata and execute arbitrary commands with root privileges.
CVE-2026-63295: An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges (such as enforcing restricted.containers.privilege=isolated), LXD fails to enforce the requirement if an instance configuration omits the security.idmap.isolated key. An attacker can exploit this flaw by creating or updating an instance without explicitly setting security.idmap.isolated, bypassing the target project's security constraints.
CVE-2026-63296: An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without validating the new configuration against the target project's enforced restrictions. An attacker can exploit this flaw to move instances with disallowed high-privilege configurations into restricted projects, bypassing security controls.
CVE-2026-63297: An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction checks before configuration merging is complete, creating a time-of-check to time-of-use (TOCTOU) condition. An attacker can exploit this flaw to copy instances with disallowed high-privilege configurations into restricted projects, bypassing security controls.
CVE-2026-63298: An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration values, an attacker can manipulate the generated lxc.conf file. This flaw enables the attacker to execute arbitrary code on the host system with the privileges of the LXD daemon.
CVE-2026-63299: An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil (Config == nil). An attacker can exploit these flaws to allocate storage resources that exceed the administrative limits configured for a project.
CVE-2026-63300: An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker with can_create_instances permissions on a restricted project to bypass project-level security restrictions. When migrating an instance between projects, LXD fails to validate the instance's configuration against the target project's enforced restrictions (such as restricted.containers.lowlevel, restricted.devices.*, and restricted.networks.access). An attacker can exploit this by creating a disallowed or high-privilege instance in an unrestricted project and subsequently moving it into the restricted project.
CVE-2026-66898: A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploit this flaw by supplying a crafted backup archive with malicious instance or volume names containing path traversal sequences, potentially allowing file access or overwriting outside the designated restore directory.

4 ignored issues:

CVE-2024-6156: Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store.
CVE-2025-54289: Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format
CVE-2025-54290: Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints.
CVE-2025-54291: Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.

Created: 2026-08-15 Last update: 2026-08-22 04:50

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2024-6156: Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store.

Created: 2025-08-09 Last update: 2025-08-13 17:04

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2024-6156: Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store.

Created: 2024-12-06 Last update: 2025-08-10 06:32

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2026-08-21 Last update: 2026-08-24 03:00

news

[2026-06-30] Accepted lxd 5.0.2+git20231211.1364ae4-9+deb13u7 (source) into proposed-updates (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-06-28] Accepted lxd 5.0.2+git20231211.1364ae4-9+deb13u7 (source) into stable-security (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-05-04] Accepted lxd 5.0.2+git20231211.1364ae4-9+deb13u6 (source) into proposed-updates (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-05-04] Accepted lxd 5.0.2-5+deb12u6 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-05-04] Accepted lxd 5.0.2+git20231211.1364ae4-9+deb13u6 (source) into stable-security (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-05-04] Accepted lxd 5.0.2-5+deb12u6 (source) into oldstable-security (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-04-18] Accepted lxd 5.0.2-5+deb12u5 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-04-18] Accepted lxd 5.0.2+git20231211.1364ae4-9+deb13u5 (source) into proposed-updates (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-04-15] Accepted lxd 5.0.2+git20231211.1364ae4-9+deb13u5 (source) into stable-security (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-04-15] Accepted lxd 5.0.2-5+deb12u5 (source) into oldstable-security (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-04-02] Accepted lxd 5.0.2+git20231211.1364ae4-9+deb13u4 (source) into proposed-updates (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-04-02] Accepted lxd 5.0.2-5+deb12u4 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-03-31] Accepted lxd 5.0.2+git20231211.1364ae4-9+deb13u4 (source) into stable-security (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-03-31] Accepted lxd 5.0.2-5+deb12u4 (source) into oldstable-security (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-03-13] Accepted lxd 5.0.2-5+deb12u3 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-03-01] Accepted lxd 5.0.2+git20231211.1364ae4-9+deb13u3 (source) into proposed-updates (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-03-01] Accepted lxd 5.0.2+git20231211.1364ae4-9+deb13u3 (source) into stable-security (Debian FTP Masters) (signed by: Mathias Gibbens)
[2026-03-01] Accepted lxd 5.0.2-5+deb12u3 (source) into oldstable-security (Debian FTP Masters) (signed by: Mathias Gibbens)
[2025-12-07] Accepted lxd 5.0.2+git20231211.1364ae4-9+deb13u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Mathias Gibbens)
[2025-11-14] Accepted lxd 5.0.2-5+deb12u2 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Mathias Gibbens)
[2025-11-13] Accepted lxd 5.0.2-5+deb12u2 (source) into oldstable-security (Debian FTP Masters) (signed by: Mathias Gibbens)
[2025-10-19] Accepted lxd 5.0.2-5+deb12u1 (source amd64) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Mathias Gibbens)
[2025-10-19] Accepted lxd 5.0.2+git20231211.1364ae4-9+deb13u1 (source all amd64) into proposed-updates (Debian FTP Masters) (signed by: Mathias Gibbens)
[2025-10-17] Accepted lxd 5.0.2-5+deb12u1 (source amd64) into oldstable-security (Debian FTP Masters) (signed by: Mathias Gibbens)
[2025-10-17] Accepted lxd 5.0.2+git20231211.1364ae4-9+deb13u1 (source all amd64) into stable-security (Debian FTP Masters) (signed by: Mathias Gibbens)
[2025-08-14] lxd REMOVED from testing (Debian testing watch)
[2025-05-08] lxd 5.0.2+git20231211.1364ae4-9 MIGRATED to testing (Debian testing watch)
[2025-04-27] Accepted lxd 5.0.2+git20231211.1364ae4-9 (source) into unstable (Mathias Gibbens)
[2025-03-01] lxd 5.0.2+git20231211.1364ae4-8 MIGRATED to testing (Debian testing watch)
[2025-02-23] Accepted lxd 5.0.2+git20231211.1364ae4-8 (source) into unstable (Mathias Gibbens)

1
2

bugs [bug history graph]

all: 1
RC: 0
I&N: 1
M&W: 0
F&P: 0
patch: 1

links

homepage
buildd: logs, cross
popcon
browse source code
other distros
security tracker
debci

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing