CVE-2026-63298

An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration values, an attacker can manipulate the generated lxc.conf file. This flaw enables the attacker to execute arbitrary code on the host system with the privileges of the LXD daemon.

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/canonical/lxd/security/advisories/GHSA-vfh7-q59q-54v2	Vendor Advisory Exploit Mitigation
https://github.com/canonical/lxd/security/advisories/GHSA-vfh7-q59q-54v2	Vendor Advisory Exploit Mitigation

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:canonical:lxd::::::::
	cpe:2.3:a:canonical:lxd::::::::
	cpe:2.3:a:canonical:lxd::::::::
	cpe:2.3:a:canonical:lxd::::::::

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de neutralización inadecuada de elementos especiales en el manejo de la configuración de instancias NVIDIA de LXD permite a un atacante autenticado inyectar directivas de configuración arbitrarias. Al proporcionar caracteres de nueva línea dentro de los valores de configuración ’nvidia.driver.capabilities’ o ’nvidia.require.*’, un atacante puede manipular el archivo lxc.conf generado. Esta falla permite al atacante ejecutar código arbitrario en el sistema anfitrión con los privilegios del demonio LXD.

Information

Published : 2026-08-12 20:17

Updated : 2026-10-24 16:10

NVD link : CVE-2026-63298

Mitre link : CVE-2026-63298

CVE.ORG link : CVE-2026-63298

JSON object : View

Products Affected

canonical

lxd

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-63298", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63298", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-13T14:33:35.469940Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security@ubuntu.com", "affectedData": [{"repo": "https://github.com/canonical/lxd", "vendor": "Canonical", "product": "LXD", "versions": [{"status": "affected", "version": "5.0.0", "lessThan": "5.0.8", "versionType": "semver"}, {"status": "affected", "version": "5.21.0", "lessThan": "5.21.6", "versionType": "semver"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.12", "versionType": "semver"}], "platforms": ["Linux"], "packageName": "LXD", "defaultStatus": "unaffected"}]}], "published": "2026-08-12T20:17:47.713", "references": [{"url": "https://github.com/canonical/lxd/security/advisories/GHSA-vfh7-q59q-54v2", "tags": ["Vendor Advisory", "Exploit", "Mitigation"], "source": "security@ubuntu.com"}, {"url": "https://github.com/canonical/lxd/security/advisories/GHSA-vfh7-q59q-54v2", "tags": ["Vendor Advisory", "Exploit", "Mitigation"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration values, an attacker can manipulate the generated lxc.conf file. This flaw enables the attacker to execute arbitrary code on the host system with the privileges of the LXD daemon."}, {"lang": "es", "value": "Una vulnerabilidad de neutralizaci\u00f3n inadecuada de elementos especiales en el manejo de la configuraci\u00f3n de instancias NVIDIA de LXD permite a un atacante autenticado inyectar directivas de configuraci\u00f3n arbitrarias. Al proporcionar caracteres de nueva l\u00ednea dentro de los valores de configuraci\u00f3n \u2019nvidia.driver.capabilities\u2019 o \u2019nvidia.require.*\u2019, un atacante puede manipular el archivo lxc.conf generado. Esta falla permite al atacante ejecutar c\u00f3digo arbitrario en el sistema anfitri\u00f3n con los privilegios del demonio LXD."}], "lastModified": "2026-10-24T16:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "89DC62EE-69CD-4ACD-BB83-6A0635AC341C", "versionEndExcluding": "4.0.12", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "59D070D6-84D2-400E-8260-EA52E5C60D37", "versionEndExcluding": "5.0.8", "versionStartIncluding": "5.0.0"}, {"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "575036D1-2B55-4043-B94A-1584E3F2DA37", "versionEndExcluding": "5.21.6", "versionStartIncluding": "5.1"}, {"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "372FD242-9957-420D-BDDC-D4C81BB996D4", "versionEndIncluding": "6.9", "versionStartIncluding": "6.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}