CVE-2026-62941: Incorrect Authorization

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check AllowInstanceCreation runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys including...

GO-2026-5368 VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf in github.com/canonical/lxd

VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf in github.com/canonical/lxd...

CVE-2026-34177

The CVE concerns Canonical LXD versions 4.12–6.7. It documents an incomplete denylist in isVMLowLevelOptionForbidden (lxd/project/limits/permissions.go) that omits raw.apparmor and raw.qemu.conf from restricted.virtual-machines.lowlevel=block. A remote attacker who has can_edit permission on a VM...

CVE-2026-34177

Canonical LXD versions 4.12 through 6.7 contain an incomplete denylist in isVMLowLevelOptionForbidden lxd/project/limits/permissions.go, which omits raw.apparmor and raw.qemu.conf from the set of keys blocked under the restricted.virtual-machines.lowlevel=block project restriction. A remote...