Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-63298

LXD arbitrary lxc.conf directive injection via NVIDIA instance configuration

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
canonical

Description

An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration values, an attacker can manipulate the generated lxc.conf file. This flaw enables the attacker to execute arbitrary code on the host system with the privileges of the LXD daemon.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Canonical LXD

Default version status: unaffected

  • 5.0.0 to < 5.0.8affected
  • 5.21.0 to < 5.21.6affected
  • 4.0.0 to < 4.0.12affected

References