{"id":"GO-2026-6917","summary":"LXD allows cross-guest volume hijack via DevLXD device patch in github.com/canonical/lxd","details":"LXD allows cross-guest volume hijack via DevLXD device patch in github.com/canonical/lxd","aliases":["CVE-2026-12411","GHSA-hhf9-qw4v-72xp"],"modified":"2026-11-06T00:15:13.100708072Z","published":"2026-11-05T23:49:57Z","database_specific":{"url":"https://pkg.go.dev/vuln/GO-2026-6917","review_status":"REVIEWED"},"references":[{"type":"ADVISORY","url":"https://github.com/canonical/lxd/security/advisories/GHSA-hhf9-qw4v-72xp"},{"type":"FIX","url":"https://github.com/canonical/lxd/commit/752e25cfb849a349ff08939ce02747ef4d4e69cc"},{"type":"FIX","url":"https://github.com/canonical/lxd/commit/7cb96ac80a6d52a96b53b0ae06a8659606fa8dd8"},{"type":"FIX","url":"https://github.com/canonical/lxd/pull/18585"}],"affected":[{"package":{"name":"github.com/canonical/lxd","ecosystem":"Go","purl":"pkg:golang/github.com/canonical/lxd"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-20250721152936-fe86ceb2c3fa"},{"fixed":"0.0.0-20260626085133-7cb96ac80a6d"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6917.json"}}],"schema_version":"1.9.2"}