- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 14
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
14 assets you may test, 5 excluded.
Web 1
- https://canonical.com/lxd
Products and areas 13
- Authentication and authorisation: TLS client certificates, OIDC, the trust store and the fine-grained permission model
- Backup, export and restore, including archive creation, the helpers invoked and extraction
- Image handling: import, unpacking, templates and the contents of any supplied image
- Instance configuration for containers and virtual machines, covering devices, profiles and disk attachments
- LXD takes reports through GitHub private vulnerability reporting on canonical/lxd, handled by the Ubuntu Security Team under Canonical's published disclosure and embargo policy. That policy governs process and credit rather than declaring a component boundary, so the whole product below is in scope
- Migration and clustering, where one cluster member trusts another and accepts state from it
- Networking: managed bridges, OVN integration, forwards and the firewall rules generated on the host
- Projects and the restriction model separating one project's instances, networks and storage from another's
- Storage drivers and volume handling in full, including attach, detach, custom volumes and snapshots
- The exec, file transfer and console paths, where the daemon acts on a path inside a running instance
- The guest-facing DevLXD endpoint an instance can reach from inside itself
- The lxc command-line client and the snap packaging that ships the daemon
- The LXD daemon and its REST API in full, over both the local UNIX socket and the network listener
Out of scope (5)
- Escapes from privileged containers, which the container runtime beneath LXD does not treat as root-safe
- Findings that only reproduce on Incus, which is a separate project with separate reporting
- LXC and LXCFS defects below LXD, handled by the Linux Containers project under its own security page
- Operator configuration that deliberately removes isolation, such as running an instance privileged or exposing the network listener to an untrusted network
- Ubuntu kernel and QEMU defects rather than LXD's handling of them
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz.
-
Report through GitHub private vulnerability reporting on canonical/lxd, the channel SECURITY.md names, backed by the Ubuntu Security Team
-
Credit runs through the CVE assignment and the Ubuntu Security Notice, with real names used by default. Say up front if you want a handle or no credit
-
If the finding reproduces on Incus as well, note it, because that side reports separately to the Linux Containers project
-
Say whether the target was a container or a virtual machine, and whether the container was privileged.
-
State how the daemon was reached: the local UNIX socket, the network listener and DevLXD from inside an instance are three different trust levels
-
Give the snap channel and revision as well as the version string.
Not accepted
-
Escapes from privileged containers, which the container runtime beneath LXD does not treat as root-safe
-
LXC and LXCFS defects below LXD
-
Ubuntu kernel and QEMU defects rather than LXD's handling of them
-
Findings that only reproduce on Incus
-
Operator configuration that deliberately removes isolation
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-66897 | A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates the path against a confined os.Root directory handle but subsequently opens and creates the file using | Critical 9.9 | 24 Aug 2026 |
| CVE-2026-66898 | A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploit this flaw by supplying a crafted backup archive with malicious instance or volume names containing pa | Critical 9.9 | 12 Aug 2026 |
| CVE-2026-13476 | IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute arbitrary commands with service account privileges on the system due to improper validation of user supplied input. | High 7.3 | 12 Aug 2026 |
| CVE-2026-16033 | A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory (specifically affecting virtual machine / QEMU driver execution paths). An attacker can exploit this flaw by providing a cr | High 8.5 | 12 Aug 2026 |
| CVE-2026-13367 | IBM Informix Dynamic Server 14.10, and 15.0 contain a local privilege escalation vulnerability in the oninit setuid-root utility. | High 7.8 | 12 Aug 2026 |
| CVE-2026-63297 | An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction checks before configuration merging is complete, creating a time-of-check to time-of-use (TOCTOU) condition. An attacker can | Critical 9.9 | 12 Aug 2026 |
| CVE-2026-63298 | An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration values, an attacker can manipulate the generated lxc.conf file. This flaw enables the attacker to execut | Critical 9.9 | 12 Aug 2026 |
| CVE-2026-63299 | An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check | Critical 9.9 | 12 Aug 2026 |
| CVE-2026-63300 | An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker with can_create_instances permissions on a restricted project to bypass project-level security restrictions. When migrating an instance between projects, LXD fails to validate the instance's configuration against the target project's enforced restrictions (such | Critical 9.9 | 12 Aug 2026 |
| CVE-2026-62420 | An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/{name} with migration: true, project: <target>, and target: <member>, the destination node skips all project restriction checks because the r | Critical 9.9 | 12 Aug 2026 |
| CVE-2026-63293 | A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a crafted image archive with a symlinked metadata.yaml file pointing to target file paths on the host sys | Critical 9.9 | 12 Aug 2026 |
| CVE-2026-63294 | A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can exploit this flaw by providing a malicious archive with a symlinked backup.yaml file, causing LXD to proce | Critical 9.9 | 12 Aug 2026 |
| CVE-2026-63295 | An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges (such as enforcing restricted.containers.privilege=isolated), LXD fails to enforce the requirement if an instance configuration omits the security.idmap.isolated key. An attacker can exploit th | Medium 4.3 | 12 Aug 2026 |
| CVE-2026-63296 | An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without validating the new configuration against the target project's enforced restrictions. An attacker can exploit this flaw to move instances with disallowed high-privile | Critical 9.9 | 12 Aug 2026 |
| CVE-2026-28385 | In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users with the can_create_images entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a URL source, the LXD daemon fails to validate or restrict outbound destination IP addresses, allowin | Medium 5.0 | 26 Jun 2026 |
| CVE-2026-9639 | Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause a denial of service via a specially crafted custom-volume backup tarball that omits the expires_at snapshot field. | Medium 6.5 | 26 Jun 2026 |
| CVE-2026-9640 | A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy restrictions by importing a maliciously crafted instance backup containing restricted configuration keys | High 7.2 | 26 Jun 2026 |
| CVE-2026-12411 | Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled. | High 8.4 | 26 Jun 2026 |
| CVE-2026-47337 | Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops. | Low 3.3 | 28 May 2026 |
| CVE-2026-47330 | Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling code. The bug can be triggered by an unprivileged local user and can result in the incorrect caching of AppArmor notification responses. | Low 3.3 | 28 May 2026 |
| CVE-2026-47331 | Ubuntu Linux 6.8 contains AppArmor SAUCE patches which fail to acquire a lock when modifying a linked list. An unprivileged local user could trigger the race condition that can lead to a use-after-free (UAF) and, theoretically, arbitrary code execution. | High 7.8 | 28 May 2026 |
| CVE-2026-47332 | Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in information disclosure from adjacent slab objects. | Medium 5.5 | 28 May 2026 |
| CVE-2026-47333 | Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine. | High 7.8 | 28 May 2026 |
| CVE-2026-47334 | Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be triggered by an unprivileged local user and can result in kernel panic or deadlock. | Medium 5.5 | 28 May 2026 |
| CVE-2026-47335 | Ubuntu Linux 6.8 contains SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel panic. | Medium 5.5 | 28 May 2026 |
| CVE-2026-47336 | Ubuntu Linux 6.8 contains SAUCE patches with a possible use of an uninitialized variable in AppArmor AF_INET/AF_INET6 socket mediation code. The bug can be triggered by an unprivileged local user and could result in incorrect fine-grained mediation of network sockets. | Low 3.3 | 28 May 2026 |
| CVE-2026-47328 | Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion. | Medium 6.1 | 28 May 2026 |
| CVE-2026-47329 | Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be triggered by an unprivileged local user and could result in handling of crafted responses. | Low 3.3 | 28 May 2026 |
| CVE-2026-47326 | Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can be triggered by an unprivileged local user. The memory leak could lead to resource exhaustion. | Medium 5.5 | 28 May 2026 |
| CVE-2026-47327 | Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops. | Low 3.3 | 28 May 2026 |
| CVE-2026-49237 | An issue was discovered in Canonical Multipass for macOS before version 1.16.3 due to an incomplete fix for CVE-2025-5199. While the patch in version 1.16.0 updated the ownership of the multipassd daemon binary to root:wheel, five co-located binaries (multipass, qemu-img, qemu-system-aarch64, qemu-system-x86_64, and sshfs_server) in /Library/Application Support/com.canonical.multipass/bin/ retain | High 7.8 | 28 May 2026 |
| CVE-2026-49238 | An issue was discovered in Canonical Multipass before version 1.16.3. The host-side SFTP server component (sshfs_server), which executes with root privileges on the host, contains a path containment bypass vulnerability within its validate_path function in src/sshfs_mount/sftp_server.cpp. The function performs a plain string prefix comparison on requested paths without path separator validation or | High 8.4 | 28 May 2026 |
| CVE-2018-25306 | PDFunite 0.41.0 contains a buffer overflow vulnerability that allows local attackers to crash the application by processing malformed PDF files during merge operations. Attackers can trigger a segmentation fault in the XRef::getEntry function within libpoppler by providing a specially crafted PDF file to the pdfunite utility. | Medium 6.9 | 29 Apr 2026 |
| CVE-2026-31431 | In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy | High 7.8 | 22 Apr 2026 |
| CVE-2026-6369 | An improper access control vulnerability in the canonical-livepatch snap client prior to version 10.15.0 allows a local unprivileged user to obtain a sensitive, root-level authentication token by sending an unauthenticated request to the livepatchd.sock Unix domain socket. This vulnerability is exploitable on systems where an administrator has already enabled the Livepatch client with a valid Ubun | Medium 5.7 | 20 Apr 2026 |
| CVE-2026-5412 | In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privileged user to access sensitive credentials. This issue is resolved in Juju versions 2.9.57 and 3.6.21. | Critical 9.9 | 10 Apr 2026 |
| CVE-2026-5774 | Improper synchronization of the userTokens map in the API server in Canonical Juju 4.0.5, 3.6.20, and 2.9.56 may allow an authenticated user to possibly cause a denial of service on the server or possibly reuse a single-use discharge token. | Medium 6.0 | 10 Apr 2026 |
| CVE-2025-15480 | In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, ubuntu-desktop-provision could include the user's password hash in the attached logs. | Low 2.7 | 9 Apr 2026 |
| CVE-2025-14551 | In Ubuntu, Subiquity version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, Subiquity could include certain user credentials, such as the user's plaintext Wi-Fi password, in the attached logs. | Low 2.7 | 9 Apr 2026 |
| CVE-2026-34177 | Canonical LXD versions 4.12 through 6.7 contain an incomplete denylist in isVMLowLevelOptionForbidden (lxd/project/limits/permissions.go), which omits raw.apparmor and raw.qemu.conf from the set of keys blocked under the restricted.virtual-machines.lowlevel=block project restriction. A remote attacker with can_edit permission on a VM instance in a restricted project can inject an AppArmor rule and | Critical 9.1 | 9 Apr 2026 |
| CVE-2026-34178 | In Canonical LXD before 6.8, the backup import path validates project restrictions against backup/index.yaml in the supplied tar archive but creates the instance from backup/container/backup.yaml, a separate file in the same archive that is never checked against project restrictions. An authenticated remote attacker with instance-creation permission in a restricted project can craft a backup archi | Critical 9.1 | 9 Apr 2026 |
| CVE-2026-34179 | In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate the Type field when handling PUT/PATCH requests to /1.0/certificates/{fingerprint} for restricted TLS certificate users, allowing a remote authenticated attacker to escalate privileges to cluster admin. | Critical 9.1 | 9 Apr 2026 |
| CVE-2025-68152 | Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators called ‘charms’. From versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19, it is possible that a compromised workload machine under a Juju controller can read any log file for any entity in any model at any level. This issue has been patched | Medium 6.9 | 3 Apr 2026 |
| CVE-2025-68153 | Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators called ‘charms’. From versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19, any authenticated user, machine or controller under a Juju controller can modify the resources of an application within the entire controller. This issue has been pat | High 7.1 | 3 Apr 2026 |
| CVE-2026-4370 | A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4.0.4, where the internal Dqlite database cluster fails to perform proper TLS client and server authentication. Specifically, the Juju controller's database endpoint does not validate client certificates when a new node attempts to join the cluster. An unauthenticated attacker with network reachabilit | Critical 10.0 | 1 Apr 2026 |
| CVE-2026-32694 | In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret owner relies exclusively on a predictable XID of the secret to verify ownership. This allows a malicious grantee which can request secrets to predict past secrets granted by the same secret owner to different grantees, allowing them to use the resources granted by those past secre | Medium 6.6 | 18 Mar 2026 |
| CVE-2026-32692 | An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3.1.6 through 3.6.18 allows an authenticated unit agent to perform unauthorized updates to secret revisions. With sufficient information, an attacker can poison any existing secret revision within the scope of that Vault secret back-end. | High 7.6 | 18 Mar 2026 |
| CVE-2026-32693 | In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is not performed correctly, which allows a grantee to update the secret content, and can lead to reading or updating other secrets. When the "secret-set" tool logs an error in an exploitation attempt, the secret is still updated contrary to expectations, and the new value is visible to both the owner and the gran | High 8.8 | 18 Mar 2026 |
| CVE-2026-32691 | A race condition in the secrets management subsystem of Juju versions 3.0.0 through 3.6.18 allows an authenticated unit agent to claim ownership of a newly initialized secret. Between generating a Juju Secret ID and creating the secret's first revision, an attacker authenticated as another unit agent can claim ownership of a known secret. This leads to the attacking unit being able to read the con | Medium 5.3 | 18 Mar 2026 |
| CVE-2026-3888 | Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS. | High 7.8 | 17 Mar 2026 |
| CVE-2026-3497 | Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange t | Medium 6.9 | 12 Mar 2026 |
| CVE-2026-28384 | An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the snap versions 5.0.6-e49d9f4 (channel 5.0/stable), 5.21.4-1374f39 (channel 5.21/stable), and 6.7-1f11451 | Critical 9.4 | 12 Mar 2026 |
| CVE-2026-3351 | Improper authorization in the API endpoint GET /1.0/certificates in Canonical LXD 6.6 on Linux allows an authenticated, restricted user to enumerate all certificate fingerprints trusted by the lxd server. | Low 2.1 | 3 Mar 2026 |
| CVE-2025-5467 | It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups. | Low 1.9 | 10 Dec 2025 |
| CVE-2025-6966 | NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key. | Medium 6.9 | 5 Dec 2025 |
| CVE-2025-33208 | NVIDIA TAO contains a vulnerability where an attacker may cause a resource to be loaded via an uncontrolled search path. A successful exploit of this vulnerability may lead to escalation of privileges, data tampering, denial of service, information disclosure. | High 8.8 | 3 Dec 2025 |
| CVE-2025-7044 | An Improper Input Validation vulnerability exists in the user websocket handler of MAAS. An authenticated, unprivileged attacker can intercept a user.update websocket request and inject the is_superuser property set to true. The server improperly validates this input, allowing the attacker to self-promote to an administrator role. This results in full administrative control over the MAAS deploymen | High 7.7 | 3 Dec 2025 |
| CVE-2025-54293 | Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attackers to read arbitrary files on the host system via crafted log file names or symbolic links. | High 7.1 | 2 Oct 2025 |
| CVE-2025-54292 | Path traversal in Canonical LXD LXD-UI versions before 6.5 and 5.21.4 on all platforms allows remote authenticated attackers to access or modify unintended resources via crafted resource names embedded in URL paths. | Medium 4.8 | 2 Oct 2025 |
| CVE-2025-54291 | Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses. | Medium 6.9 | 2 Oct 2025 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 26 Last 12 months Authorization / restriction bypass 35 % Arbitrary file read/write 25 % Cross-guest access 25 % Command injection 15 % Latest advisories Loading the feed Overview LXD is Canonical's system container and virtual machine manager, continuing under Canonical after the Incus fork. It ships in the Ubuntu Server toolchain and is the container substrate beneath MAAS and Juju estates. Twenty-six advisories landed in the last twelve months, most shared with Incus through the common codebase heritage and some specific to this side, including CVE-2026-12411, a cross-guest volume hijack through a DevLXD device patch. Canonical states in its published disclosure policy that it is not affiliated with any bug bounty programme and does not pay for bug reports in its software. sorona.xyz pays you directly on qualified, reproduced findings. In scope LXD takes reports through GitHub private vulnerability reporting on canonical/lxd, handled by the Ubuntu Security Team under Canonical's published disclosure and embargo policy. That policy governs process and credit rather than declaring a component boundary, so the whole product below is in scope The LXD daemon and its REST API in full, over both the local UNIX socket and the network listener Authentication and authorisation: TLS client certificates, OIDC, the trust store and the fine-grained permission model Projects and the restriction model separating one project's instances, networks and storage from another's Image handling: import, unpacking, templates and the contents of any supplied image Instance configuration for containers and virtual machines, covering devices, profiles and disk attachments The guest-facing DevLXD endpoint an instance can reach from inside itself Storage drivers and volume handling in full, including attach, detach, custom volumes and snapshots Backup, export and restore, including archive creation, the helpers invoked and extraction Migration and clustering, where one cluster member trusts another and accepts state from it Networking: managed bridges, OVN integration, forwards and the firewall rules generated on the host The exec, file transfer and console paths, where the daemon acts on a path inside a running instance The lxc command-line client and the snap packaging that ships the daemon Out of scope Escapes from privileged containers, which the container runtime beneath LXD does not treat as root-safe LXC and LXCFS defects below LXD, handled by the Linux Containers project under its own security page Ubuntu kernel and QEMU defects rather than LXD's handling of them Findings that only reproduce on Incus, which is a separate project with separate reporting Operator configuration that deliberately removes isolation, such as running an instance privileged or exposing the network listener to an untrusted network Most-valued findings Cross-guest reach through the device and volume model. CVE-2026-12411 hijacked another guest's volume through a DevLXD device patch, and on a shared host that is the shape that matters most Project restriction bypass leading to command execution, the class CVE-2026-48751 landed in as a critical Arbitrary host file read or write driven from an instance or a supplied image, the family LXD shares with Incus through the common codebase Argument injection into host-side helpers invoked for backup, compression or storage operations Anything reachable over DevLXD, since that endpoint is guest-facing by design and has already produced a cross-guest compromise Unprivileged container escape, the boundary this stack does treat as real Authorisation defects on the network listener, where a client certificate or token reaches operations outside its granted entitlements Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report through GitHub private vulnerability reporting on canonical/lxd, the channel SECURITY.md names, backed by the Ubuntu Security Team Handling follows Canonical's published disclosure and embargo policy, which also states plainly that Canonical does not pay for bug reports Credit runs through the CVE assignment and the Ubuntu Security Notice, with real names used by default. Say up front if you want a handle or no credit LXD is Canonical's fork. If the finding reproduces on Incus as well, note it, because that side reports separately to the Linux Containers project Say whether the target was a container or a virtual machine, and whether the container was privileged. The privileged container boundary is not treated as root-safe by the runtime beneath State how the daemon was reached: the local UNIX socket, the network listener and DevLXD from inside an instance are three different trust levels Give the snap channel and revision as well as the version string. LXD ships primarily as a snap and the revision matters for reproduction Disclosure Coordinated by the Ubuntu Security Team through the GitHub private advisory workflow, with an OpenPGP key and a published embargo policy behind it. Publication lands as a GitHub Security Advisory on canonical/lxd with a CVE assigned, and as an Ubuntu Security Notice where a shipped package is affected. The 2026 record shows advisories publishing in batches alongside Incus, so plan for a coordinated release date rather than a fixed day count. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability