CVE-2026-63294: LXD RCE Vulnerability

CVE-2026-63294 Overview

CVE-2026-63294 is a link following vulnerability [CWE-59] in LXD, the system container and virtual machine manager maintained by Canonical. The flaw resides in how LXD processes the backup.yaml file during the import or unpacking of image or backup archives. When backup.yaml exists as a symbolic link inside a crafted archive, LXD fails to validate and confine the file, causing it to read and act on attacker-controlled configuration metadata outside the intended path. Successful exploitation results in arbitrary command execution with root privileges on the host system.

Critical Impact
An authenticated attacker who can supply a crafted image or backup archive to LXD can execute arbitrary commands as root on the underlying host, breaking container isolation and compromising the entire system.

Affected Products

Canonical LXD (system container and VM manager)
LXD deployments accepting image or backup archive imports
Hosts running LXD as a privileged service

Discovery Timeline

2026-08-12 - CVE-2026-63294 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-63294

Vulnerability Analysis

The vulnerability is a symlink following issue classified as [CWE-59] Improper Link Resolution Before File Access. LXD supports importing container state through image tarballs and backup archives. Each archive contains a backup.yaml metadata file that describes container configuration, storage volumes, and profiles applied on restore.

During the unpacking routine, LXD reads backup.yaml without verifying that the extracted entry is a regular file confined to the archive root. When the entry is a symbolic link pointing outside the archive, LXD follows it and processes the target as if it were legitimate metadata. Because LXD acts on the parsed configuration with root authority, attacker-controlled fields translate directly into privileged operations on the host.

Root Cause

The root cause is missing validation of file type and path confinement during archive extraction. LXD trusts the presence of backup.yaml inside the unpacked directory and does not verify that the path resolves to a regular file within the expected boundary. Symbolic links are followed rather than rejected or resolved relative to the extraction root.

Attack Vector

An attacker crafts a malicious backup or image archive in which backup.yaml is a symbolic link to attacker-controlled content, or in which the parsed metadata triggers privileged operations. The attacker delivers this archive to a target LXD instance through any supported import path, including lxc image import or backup restore. When LXD processes the archive, it reads the unconfined metadata and executes configuration actions that lead to root command execution on the host.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-fv82-v4fj-mm4m for the vendor description.

Detection Methods for CVE-2026-63294

Indicators of Compromise

Presence of symbolic links named backup.yaml inside imported LXD image or backup tarballs.
Unexpected root-owned processes spawned as children of the lxd daemon during or immediately after archive import operations.
New or modified files outside standard LXD storage paths (/var/lib/lxd/ or /var/snap/lxd/common/lxd/) created during import.

Detection Strategies

Inspect archive contents before import using tar -tvf archive.tar and reject any entry where backup.yaml appears with a link indicator (l in the type column).
Correlate LXD audit logs for image import, backup import, and init operations with process creation events on the host.
Alert on shell or interpreter processes spawned by the LXD daemon that are not part of normal container lifecycle activity.

Monitoring Recommendations

Enable verbose logging in LXD and forward /var/log/lxd/ or snap-equivalent logs to a centralized log platform for review.
Monitor filesystem changes in /etc, /root, and /usr/local/bin for writes originating from the lxd process during import events.
Track LXD API calls tied to image and backup import endpoints and flag imports from untrusted sources or unauthenticated users.

How to Mitigate CVE-2026-63294

Immediate Actions Required

Upgrade LXD to the fixed release identified in the Canonical security advisory GHSA-fv82-v4fj-mm4m.
Restrict who can import images and backups by limiting LXD API access to trusted operators and revoking unnecessary client certificates.
Audit recent image and backup imports for archives containing symbolic links at the root level.

Patch Information

Canonical has published a security advisory for this issue. Refer to GHSA-fv82-v4fj-mm4m for the fixed versions and upgrade guidance. Snap-based deployments should refresh to the patched channel using snap refresh lxd.

Workarounds

Do not import LXD image or backup archives from untrusted sources until patches are applied.
Validate archives before import by extracting them into a scratch directory and rejecting any that contain symlinks for backup.yaml.
Isolate the LXD host on a management network and disable the HTTPS listener (lxc config unset core.https_address) if remote import is not required.

bash

# Configuration example: pre-import archive validation
tar -tvf suspicious-backup.tar.gz | awk '$1 ~ /^l/ {print "symlink found:", $0; found=1} END {exit found}'

# Upgrade LXD via snap on patched systems
sudo snap refresh lxd

# Restrict remote access if not required
lxc config unset core.https_address