What is the CVSS score of CVE-2026-63294?

CVE-2026-63294 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 1.0%.

Which versions of LXD are affected by CVE-2026-63294?

A critical privilege escalation in Canonical LXD enables low-privileged users with archive import permissions to reach host root access, breaking the fundamental isolation between container…. A patch is available.

How to fix or mitigate CVE-2026-63294?

Within 24 hours, enumerate all systems running Canonical LXD and identify which users and processes have permissions to import archives or backups; immediately restrict these permissions to trusted administrators only. Within 7 days, implement strict filesystem access controls to prevent untrusted users from supplying crafted archives to LXD processes, and audit historical archive imports for suspicious or unauthorized activity. Within 30 days, establish monitoring for the Canonical security advisory GHSA-fv82-v4fj-mm4m and develop a detailed patch deployment plan; once a vendor-released patch becomes available, prioritize deployment to all affected LXD systems.

LXD CVE-2026-63294

EUVD-2026-57538 CRITICAL

Improper Link Resolution Before File Access (CWE-59)

2026-08-12 security@ubuntu.com

Information Disclosure Canonical Lxd

9.9

CVSS 3.1 · Vendor: ubuntu

Severity by source

Vendor (ubuntu) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Import is normally an authenticated low-privilege API action (PR:L) over the network (AV:N); the symlink primitive is trivial (AC:L) and container-to-host root breaks scope (S:C) with full C/I/A loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Primary rating from Vendor (ubuntu).

CVSS VectorVendor: ubuntu

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 12, 2026 - 21:17 EUVD

Analysis Generated

Aug 12, 2026 - 20:46 vuln.today

CVE Published

Aug 12, 2026 - 20:17 cve.org

CRITICAL 9.9

DescriptionCVE.org

A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can exploit this flaw by providing a malicious archive with a symlinked backup.yaml file, causing LXD to process unconfined configuration metadata and execute arbitrary commands with root privileges.

AnalysisAI

Privilege escalation to host root in Canonical LXD occurs when the container manager unpacks crafted image or backup archives, because it follows a symbolic link where the backup.yaml metadata file should be and then processes attacker-controlled configuration outside its intended confinement. A low-privileged LXD user who can import a malicious archive can execute arbitrary commands as root on the underlying host, breaking the container/host trust boundary (scope change). Rated CVSS 9.9; no public exploit identified at time of analysis and not listed in CISA KEV, but the fix is coordinated through GitHub advisory GHSA-fv82-v4fj-mm4m.

Technical ContextAI

LXD is a system-container and VM manager (built on LXC/liblxc) that ships images and instance backups as archives containing a backup.yaml file describing the instance configuration and metadata. This flaw is CWE-59 (Link Following / improper link resolution): during import/unpack LXD does not verify that backup.yaml is a regular file confined within the extraction directory, so a symlink placed at that path is dereferenced and its target is read and acted upon as trusted configuration. Because the daemon runs as root on the host, processing this unconfined metadata leads to command execution with root privileges - a classic archive-extraction symlink traversal that escapes the container boundary into the host.

RemediationAI

Patch available per vendor advisory: upgrade LXD to the fixed release identified in GHSA-fv82-v4fj-mm4m (https://github.com/canonical/lxd/security/advisories/GHSA-fv82-v4fj-mm4m); the exact patched version is published there and should be applied on all hosts running the LXD daemon. Until patched, restrict who can import images and backups - treat lxc image import / lxc import (backup restore) as a privileged operation and do not accept archives from untrusted tenants or third parties, since the vulnerability triggers during unpack. As compensating controls, limit LXD API access to trusted administrators (tighten TLS client-cert trust and any restricted/project-scoped user permissions that allow import), and validate/quarantine external archives out-of-band before import; the trade-off is reduced self-service for tenants and added operational overhead. Avoid importing backups produced on untrusted hosts.