CVE WatchJul 2, 2026

CVE-2026-12411

Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite a

CVSS

8.4

High

EPSS

0.2%

p11

KEV

—

Exploit Today

0-100

Published: Jun 26, 2026 · Last modified: Jul 2, 2026 · CWE-639 · CWE-862

EPSS · 30d

0.1%EPSS · 30 days0.2%

2026-06-302026-07-17

Technical description

Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-552558.4 HIG

42.8%

KEV—63Langflow Authorization Bypass Through User-Controlled Key Vulnerability10d CVE-2026-277718.2 HIG

98.5%

——30Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.11d CVE-2023-361447.5 HIG

98.3%

——30An authentication bypass in Intelbras Switch SG 2404 MR in firmware 1.00.54 allows an unauthenticated attacker to download the backup file of the device, exposing critical information about the device configuration.9d CVE-2021-445958.8 HIG

97.3%

——29Wondershare Dr. Fone Latest version as of 2021-12-06 is vulnerable to Incorrect Access Control. A normal user can send manually crafted packets to the ElevationService.exe and execute arbitrary code without any validation with SYSTEM privileges.9d CVE-2021-464168.1 HIG

89.9%

——27Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling.5d CVE-2020-253669.1 CRI

82.0%

——25An issue in the component /cgi-bin/upload_firmware.cgi of D-Link DIR-823G REVA1 1.02B05 allows attackers to cause a denial of service (DoS) via unspecified vectors.9d