CVE-2026-66897: lxd before 4.0.13 (exclusive), from 5.0.0 (inclusive), before 5.0.9 (exclusive), from 5.1 (inclusive), before 5.21.7…

Affected technology

lxd · before 4.0.13 (exclusive)
canonical

lxd · from 5.0.0 (inclusive), before 5.0.9 (exclusive)
canonical

lxd · from 5.1 (inclusive), before 5.21.7 (exclusive)
canonical

lxd · from 6.0 (inclusive), through 6.9 (inclusive)
canonical

LXD · 4.0.0 to before 4.0.13, 5.0.0 to before 5.0.9, 5.21.0 to before 5.21.7, 6.0 to before 6.10
Canonical

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An attacker can escape directory confinement, overwrite root-owned host files, and achieve host root code execution. Vendor/CNA’s CVSS 3.1 assessment (base score 9.9/10) rates confidentiality, integrity and availability impact as high.