EUVD-2026-88260Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain project-scoped instance/volume create rights or control migration source
-
DeliveryInitiate volume migration with crafted rsync/btrfs send stream
-
ExploitStream plants symlink (rootfs/root.img) in received volume
-
ExecutionWrite through symlink to arbitrary host path as root
-
PersistDrop root-level persistence (cron/SSH/systemd)
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Symlink resolution safety
|
| Exploitation Conditions | Attacker must either (a) be an authenticated LXD client with permission to create instances or custom storage volumes within a project, or (b) control/impersonate a malicious migration source server. Exploitation requires triggering a volume migration receive and supplying a crafted rsync or btrfs send stream that plants a symlink at a name like rootfs or root.img, then writing through it. Limiting factors: requires existing project-level create privileges or a position as/over the migration source (not fully anonymous pre-auth), and applies to LXD 4.0 through the versions before 4.0.14/5.0.10/5.21.8/6.10 on Linux; patched hosts are not affected. |
| Impact | This is a genuine high-priority vulnerability, not a CVSS-inflated one. The vendor-assigned CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) is internally consistent with the description: a merely project-scoped authenticated user (PR:L) - or a malicious migration source server - can escape the project boundary and write files as root on the host (S:C, C/I/A:H), which is full host compromise. The low complexity (AC:L) and network vector (AV:N) are credible because the attack rides the normal migration/rsync/btrfs-send data path. No EPSS score, no CISA KEV listing, and no public POC were provided, so this is 'no public exploit identified at time of analysis'; the finding is a vendor (Canonical) self-report via GitHub Security Advisory GHSA-fmc3-3cpq-6whr with patched versions available, which is the strongest signal of authenticity. The main factor moderating real-world urgency is the PR:L precondition (attacker must already be able to create instances/volumes in a project, or control a migration source) - this is a privilege-escalation/tenant-escape primitive rather than a pre-auth internet worm. Given a clean patch exists and the impact is root-level host takeover in multi-tenant LXD clusters, defenders running shared/delegated-project LXD should patch promptly. The input 'Information Disclosure' tag conflicts with the actual impact (arbitrary root file write / host compromise) and should be disregarded. |
| Exploit ScenarioDerived | A tenant with rights to create instances or custom storage volumes in a restricted LXD project (or an attacker operating a malicious migration source server) sends a crafted rsync or btrfs send stream during a volume migration that plants a symlink named like rootfs or root.img, then writes through that symlink to an arbitrary host path as root - for example dropping a cron job, SSH key, or systemd unit - achieving full host compromise. No public exploit code was identified at time of analysis, but the mechanism is well-described by the vendor. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Arbitrary file write as root in Canonical LXD 4.0 and later (before 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux lets an authenticated client with permission to create instances or custom storage volumes in a project - or a malicious migration source server - plant a symlink inside a transferred volume and then write through it to any path on the target host, resulting in full host compromise. Exploitation requires triggering a volume migration receive and supplying a crafted rsync or btrfs send stream that plants a symlink at a name such as rootfs or root.img; the flaw is an improper link resolution issue (CWE-59) in the receive path that does not confine link targets to the volume. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, though the independent assessment rates this a genuine high-priority vulnerability rather than a CVSS-inflated one given the authenticated, low-privilege path to root.
RemediationAI
Vendor-released patch: upgrade Canonical LXD to 4.0.14, 5.0.10, 5.21.8 or 6.10 depending on the installed branch, as documented in the advisory at https://github.com/canonical/lxd/security/advisories/GHSA-fmc3-3cpq-6whr; snap users should refresh to the patched channel and apt users should install the corresponding fixed package version. Until the upgrade is applied, reduce exposure by treating the migration receive path as untrusted input: restrict project-level permissions so that only highly trusted operators can create instances or custom storage volumes, since that is the authenticated PR:L prerequisite for the local attack variant, and avoid accepting instance or storage-volume migrations from sources that are not fully trusted or controlled, which removes the malicious-migration-source variant. Restricting create rights and inbound migration breaks self-service project workflows and cross-cluster or cross-datacenter move operations respectively, so those controls should be viewed as temporary compensating measures rather than permanent configurations. Because exploitation yields root-level file writes on the host, hosts with broad project-level create access or inbound migration exposure should be treated as potentially compromised and audited for unexpected symlinks or files written outside volume storage paths; no vendor-released patch alternative beyond the fixed versions above is identified in the available data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
LXD is Canonical's system container and virtual machine manager whose privileged daemon typically runs as root, so any file the daemon writes during storage operations lands with host-root privileges. CVE-2026-87799 sits in the migration receive path, where storage volumes are transferred between hosts using rsync streams or btrfs send/receive streams; container volumes use a rootfs payload and VM volumes use a root.img payload. The root cause class is CWE-59, improper link resolution before file access ('link following'): the receive logic resolves and follows links contained in the incoming stream without verifying that the resolved target remains inside the destination volume, so an attacker-supplied symlink named rootfs or root.img can redirect subsequent writes to arbitrary host paths. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H reflects network reachability of the migration API, low privileges (PR:L, consistent with authenticated project-level create rights), no user interaction, a scope change because the container-management context escapes to the host, and high confidentiality, integrity and availability impact. The supplied CPE cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:* is a wildcard covering all LXD releases, so the authoritative version boundaries are those stated in the advisory and assessment: all 4.0-and-later branches up to the fixed releases 4.0.14, 5.0.10, 5.21.8 and 6.10. Note that the input tags label this issue as 'Information Disclosure', which understates the assessed integrity and availability impact of writing attacker-controlled files as root.
Know when Lxd gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Project-scoped authenticated create rights (PR:L) over a network path (AV:N/AC:L) yield root file write escaping the project to the host (S:C, C/I/A:H).
Primary rating from Vendor (canonical).
CVSS VectorVendor: canonical
Lifecycle Timeline
2DescriptionCVE.org
Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client that can create instances or custom storage volumes in a project, or a malicious migration source server, to write attacker-controlled files to arbitrary paths on the target host as root, leading to full host compromise. The attacker does this with a crafted rsync or btrfs send stream that plants a symlink in the transferred volume, such as rootfs or root.img, and then writes through it.
Articles & Coverage 2
Technical POC Analysis
Bug class: CWE-59, improper link resolution in the LXD migration receive path.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Canonical LXD, the tool many organizations use to run containers and virtual machines on Linux hosts, contains a critical flaw that lets a user with permission to create instances or storage volumes - or a malicious migration source server - write files as root and take full control of the underlying host. Because LXD hosts typically underpin multi-tenant and production workload platforms, a single low-privilege tenant or a compromised migration peer could escape isolation and compromise the host and everything running on it. Leadership should treat this as a priority item wherever LXD is shared across teams or accepts migrations from outside the organization, especially since no vendor patch is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict instance-creation and custom-storage-volume permissions to trusted administrators only; disable or tightly control migration receive (rsync or btrfs send streams) from untrusted source servers; review and prune project trust and migration peer certificates; log and alert on symlink creation and writes outside expected volume paths during volume receive.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Cross-site request forgery in the LXD-UI component of Canonical LXD 5.0 before 5.0.5, 5.1 before 5.21.4, and 6.0 before
Privilege escalation in Canonical LXD's operations API (LXD before 6.5 and LXD 5.21 before 5.21.4) allows an authenticat
Authenticated remote attackers with access to the Canonical LXD instance log retrieval or deletion endpoints can read ar
Server-side template injection in Canonical LXD's instance snapshot naming feature lets an authenticated user who can mo
Unauthenticated project enumeration in Canonical LXD 5.21.x before 5.21.4 and 6.x before 6.5 lets remote attackers deter
Unauthenticated remote attackers can confirm the existence of LXD projects on Canonical LXD by comparing HTTP status cod
Privilege escalation to host root in Canonical LXD occurs when the container manager unpacks crafted image or backup arc
Host root code execution in Canonical LXD arises from a path-traversal flaw in instance template processing, letting an
Arbitrary host file read and write in Canonical LXD occurs because the image import/unpack routine does not verify wheth
Canonical LXD's NVIDIA GPU passthrough configuration handler fails to sanitize newline characters in user-supplied `nvid
Path traversal in Canonical's LXD container and VM manager allows a user with backup import/restore privileges to write
Authorization bypass in Canonical LXD (6.0 before 6.10, 5.21.x before 5.21.6, 5.0.x before 5.0.8) lets an authenticated
Exploit-DB