What is the CVSS score of CVE-2026-63293?

CVE-2026-63293 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Canonical LXD are affected by CVE-2026-63293?

Canonical LXD contains a critical container escape vulnerability (CVE-2026-63293, CVSS 9.9) enabling authenticated users with image-import rights to read or overwrite arbitrary files on the host…. A patch is available.

How to fix or mitigate CVE-2026-63293?

Within 24 hours: inventory all LXD deployments and audit which users hold image-import permissions; immediately revoke image-import rights from non-essential accounts and disable the feature entirely where operationally feasible. Within 7 days: implement mandatory image source validation, deploy host-level file integrity monitoring on sensitive directories (/etc, /root, credential stores), and enable comprehensive logging of LXD daemon activities for incident detection. Within 30 days: apply Canonical's vendor patch immediately upon release; audit all images imported during the vulnerability window for signs of compromise; conduct a full security assessment of any systems where images originated from untrusted sources.

Canonical LXD CVE-2026-63293

EUVD-2026-57540 CRITICAL

Improper Link Resolution Before File Access (CWE-59)

2026-08-12 security@ubuntu.com

Information Disclosure Canonical Lxd

9.9

CVSS 3.1 · Vendor: ubuntu

Severity by source

Vendor (ubuntu) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Reachable via the LXD API (AV:N) with low complexity; requires image-import privilege (PR:L, no UI); crosses container-to-host boundary (S:C) yielding root-level read/write, so C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Primary rating from Vendor (ubuntu).

CVSS VectorVendor: ubuntu

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 12, 2026 - 21:17 EUVD

Analysis Generated

Aug 12, 2026 - 20:46 vuln.today

CVE Published

Aug 12, 2026 - 20:17 cve.org

CRITICAL 9.9

DescriptionCVE.org

A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a crafted image archive with a symlinked metadata.yaml file pointing to target file paths on the host system.

AnalysisAI

Arbitrary host file read and write in Canonical LXD occurs because the image import/unpack routine does not verify whether the bundled metadata.yaml entry is a symbolic link, letting an authenticated user with image-import rights supply a crafted archive whose symlinked metadata.yaml resolves to sensitive host paths. Rated CVSS 9.9 with a scope change (S:C), successful exploitation crosses the container/management boundary to read or overwrite files as the LXD daemon (typically root) on the host. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; details are published only in Canonical advisory GHSA-j825-cg34-5fr5.

Technical ContextAI

LXD is Canonical's system container and virtual-machine manager whose daemon (lxd) generally runs as root and exposes a REST API for image management. Images are distributed as archives (unified or split tarballs) that include a metadata.yaml describing the image; during import/unpack LXD reads and processes this file. The flaw is a CWE-59 link-following (symlink) weakness: LXD treats the metadata.yaml path inside the archive as a regular file without checking st_mode/lstat semantics, so a symlink placed at that path is dereferenced against the host filesystem. Because the daemon runs with high privilege and the unpack step operates on host paths, dereferencing an attacker-controlled symlink yields read or write primitives against arbitrary host locations rather than being confined to the image staging directory.

RemediationAI

Upgrade LXD to the fixed release identified in Canonical advisory GHSA-j825-cg34-5fr5 (https://github.com/canonical/lxd/security/advisories/GHSA-j825-cg34-5fr5); the exact patched version is not present in the supplied data and must be taken from that advisory rather than assumed. Until patched, restrict who can import or upload images - limit image-import permissions to fully trusted operators and disable image acceptance from untrusted projects or remote users, accepting the trade-off that legitimate self-service image workflows are curtailed. Prefer importing only images from trusted, signed sources and, where feasible, unpack or inspect untrusted archives in an isolated sandbox before importing so a symlinked metadata.yaml cannot resolve against production host paths; note this adds operational overhead to image onboarding. Because the daemon typically runs as root, also review filesystem permissions and API access controls to reduce blast radius.