Canonical Multipass CVE-2026-49238

Exploitation requires that the victim host runs Canonical Multipass prior to 1.16.3 with at least one active host-to-guest mount configured via 'multipass mount' (this is what spawns the vulnerable sshfs_server process and defines the prefix being bypassed), and the attacker must already possess root privileges inside the guest VM in order to access the sshfs_server process's stdin/stdout pipes through procfs and inject raw SFTP frames. There is no network attack vector and no host-side user interaction; conversely, Multipass instances with no mounts configured do not expose the sshfs_server pipes and are not exploitable by this primitive, and unprivileged guest users cannot reach the procfs pipe endpoints needed to deliver the malicious SFTP frames.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N (8.4) accurately reflects the threat model: local access to a guest, low complexity, low privileges relative to the vulnerable component, scope change crossing the VM boundary, and high confidentiality/integrity impact on the host. The CVSS vector states I:H, but the description only demonstrates arbitrary file read; the integrity claim is plausible because SFTP SSH_FXP_OPEN supports write modes against a root-owned server, but this is inferred and not explicitly demonstrated in the advisory text supplied. No EPSS score, SSVC decision, KEV listing, or POC indicator was provided in the input, so probabilistic exploitation signals are unknown. Practically, this is a serious VM-escape primitive for any environment where untrusted workloads run inside Multipass guests (CI runners, malware analysis, multi-tenant dev sandboxes), but it requires that an attacker already control root inside the guest, which limits the population of realistically exposed deployments.

An attacker who has obtained root inside a Multipass guest (e.g. via a compromised CI job or a malicious container image running in the VM) locates the host-side sshfs_server process exposed through procfs, then writes a crafted SSH_FXP_OPEN frame whose path begins with the allowed mount prefix but embeds '../' traversal segments. The privileged sshfs_server resolves the traversal and returns a handle to a file outside the mount boundary - for example /etc/shadow or an SSH private key on the host - which the attacker reads back over the same pipe, completing a guest-to-host file disclosure and effective VM escape.