Security · High impactFan score 42 · Tier B
LXD has restricted project bypass leading to arbitrary command execution
The Brief
- The GitHub Advisory Database published an advisory on 2026-11-06 for a restricted project bypass in LXD.
- Instance snapshots ignore the restricted.containers.lowlevel=block setting.
- The flaw allows arbitrary command execution on the Incus server.
Why it matters
Operators who rely on restricted projects to limit low-level container settings may be exposed to command execution on their host server.
Who’s affected
- Operators running LXD (github.com/canonical/lxd)
- Teams running Incus with restricted projects
Affects github.com/canonical/lxd. Reported from https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv Summary Instance snapshots ignore the restricted.containers.lowlevel=block setting; allowing for arbitrary command execution on the Incus server by abusing…
Timeline
GitHub Advisory Database published the advisory
GitHub Advisory Database
LXD has restricted project bypass leading to arbitrary command execution