CVE-2026-63298 PUBLISHED

LXD arbitrary lxc.conf directive injection via NVIDIA instance configuration

Assigner: canonical
Reserved: 16.07.2026 Published: 12.08.2026 Updated: 13.08.2026

An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration values, an attacker can manipulate the generated lxc.conf file. This flaw enables the attacker to execute arbitrary code on the host system with the privileges of the LXD daemon.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 8.7

Product Status

Vendor Canonical
Product LXD
Versions Default: unaffected
  • affected from 5.0.0 to 5.0.8 (excl.)
  • affected from 5.21.0 to 5.21.6 (excl.)
  • affected from 4.0.0 to 4.0.12 (excl.)

Solutions

Upgrade to LXD version 4.0.12 or later, 5.0.8 or later, or 5.12.6 or later.

References

Problem Types

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE

Impacts

  • Input Data Manipulation
  • Privilege Escalation