Canonical vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-93336 Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a High 7.1 · Oct 22, 2026
• CVE-2026-97335 Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed in 5.0.10, 5.21.8 and 6.10) on Linux allHigh 7.7 · Sep 28, 2026
• CVE-2026-87799 Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an autCritical 9.9 · Sep 28, 2026
• CVE-2026-85526 Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or Critical 9.9 · Sep 28, 2026
• CVE-2026-85185 Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticatedCritical 9.6 · Sep 28, 2026
• CVE-2026-66897 A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, Critical 9.9 · Aug 24, 2026
• CVE-2026-61898 The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LAHigh 7.8 · Aug 20, 2026
• CVE-2026-61897 An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts.High 7.8 · Aug 20, 2026
• CVE-2026-66898 A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations.Critical 9.9 · Aug 12, 2026
• CVE-2026-16033 A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation.High 8.5 · Aug 12, 2026
• CVE-2026-63300 An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker with can_create_instaCritical 9.9 · Aug 12, 2026
• CVE-2026-63299 An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits.Critical 9.9 · Aug 12, 2026
• CVE-2026-63298 An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrarCritical 9.9 · Aug 12, 2026
• CVE-2026-63297 An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restricCritical 9.9 · Aug 12, 2026
• CVE-2026-63296 An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration.Critical 9.9 · Aug 12, 2026
• CVE-2026-63294 A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system.Critical 9.9 · Aug 12, 2026
• CVE-2026-63293 A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system.Critical 9.9 · Aug 12, 2026
• CVE-2026-62420 An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migraCritical 9.9 · Aug 12, 2026
• CVE-2026-8933 A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure High 7.8 · Jul 21, 2026
• CVE-2026-15226 A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler (snap-confine).High 8.4 · Jul 21, 2026
• CVE-2026-11386 An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools).Critical 9 · Jul 16, 2026
• CVE-2026-10037 A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu.High 8.8 · Jul 8, 2026
• CVE-2026-9640 A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restrictiHigh 7.2 · Jun 26, 2026
• CVE-2026-12411 Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custoHigh 8.4 · Jun 26, 2026
• CVE-2026-12249 An issue was discovered in Canonical ADSys upstream versions through v0.16.2.Critical 9 · Jun 22, 2026