CVE-2026-66897: LXD Path Traversal Vulnerability

CVE-2026-66897 Overview

CVE-2026-66897 is a path traversal vulnerability in LXD's instance template processing. The flaw lets an attacker with container edit permissions, or any user who launches a crafted image, overwrite arbitrary files on the host as root. LXD validates template target paths against a confined os.Root directory handle, then opens and creates the file with os.Create using an unconfined string path. Attackers exploit this discrepancy to escape directory confinement, overwrite root-owned host files, and achieve host root code execution. The vulnerability is tracked as [CWE-22] Path Traversal.

Critical Impact
Successful exploitation grants host root code execution from a low-privileged LXD user or a malicious image, breaking container isolation completely.

Affected Products

Canonical LXD (instance template processing component)
LXD deployments accepting user-supplied images or delegating container edit permissions
Multi-tenant LXD hosts where non-admin users can create or modify instances

Discovery Timeline

2026-08-24 - CVE-2026-66897 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-66897

Vulnerability Analysis

LXD processes instance templates described in metadata.yaml when creating or launching containers. Each template entry specifies a target file path inside the container that LXD renders and writes on the host filesystem. To prevent writes outside the container root, LXD validates the target path against a confined os.Root directory handle. This handle is designed to reject symbolic links and parent-directory traversal during resolution.

The validation logic and the file-write logic diverge. After the confined check passes, LXD calls os.Create with the original unconfined string path. os.Create resolves the path against the process root, not the confined handle. Symbolic links and .. segments introduced by the attacker are followed at write time. The vulnerability class is Path Traversal leading to Arbitrary File Write and Local Privilege Escalation to root.

Root Cause

The root cause is a Time-of-Check to Time-of-Use style discrepancy between path resolution APIs. os.Root enforces containment during the check, while os.Create operates on a raw string that the operating system resolves normally. Any traversal sequence or symlink chain that survives translation into the string path is honored during file creation.

Attack Vector

An attacker with container edit permissions crafts a metadata.yaml template entry whose target path resolves through a symlink or relative traversal to a host-owned file. Alternatively, an attacker publishes a malicious image containing the crafted metadata. When another user launches the image, the LXD daemon, running as root, writes attacker-controlled content into the target path. Overwriting files such as /etc/ld.so.preload, systemd unit files, or root cron entries yields host root code execution and full container escape.

No verified public proof-of-concept code is available. See the GitHub Security Advisory for vendor technical details.

Detection Methods for CVE-2026-66897

Indicators of Compromise

Unexpected writes by the LXD daemon to host paths outside instance storage directories, especially under /etc, /root, /usr/local, or systemd unit directories.
Container images or metadata.yaml files containing template target paths with .. sequences or references to symbolic links.
New or modified files owned by root with recent timestamps that correlate with container create or launch events.

Detection Strategies

Audit metadata.yaml contents of imported images and inspect template target fields for traversal patterns before import.
Enable Linux audit rules on the LXD daemon process to log openat and creat syscalls targeting paths outside /var/lib/lxd and /var/snap/lxd.
Correlate LXD API activity (image import, instance create, instance edit) with filesystem changes on the host through EDR telemetry.

Monitoring Recommendations

Monitor integrity of high-value host files including /etc/ld.so.preload, /etc/sudoers, /etc/pam.d/*, and systemd unit files.
Alert on LXD daemon child processes that execute shells, package managers, or interpreters outside expected maintenance windows.
Track use of unsigned or third-party LXD images and require review before launch in multi-tenant environments.

How to Mitigate CVE-2026-66897

Immediate Actions Required

Upgrade LXD to the fixed version identified in the Canonical LXD security advisory GHSA-q39m-8fx9-42fv.
Restrict container edit and image import permissions to trusted administrators until patching is complete.
Reject or quarantine images from untrusted sources and audit any recently imported images for malicious metadata.yaml templates.

Patch Information

Canonical has published a security advisory for LXD at GHSA-q39m-8fx9-42fv. Apply the fixed release through the standard snap channel or distribution package. The patch aligns path resolution so both validation and file creation operate through the confined os.Root handle, closing the traversal window.

Workarounds

Disable non-administrator access to container editing and image import operations through LXD project and RBAC settings.
Run LXD on hosts dedicated to trusted workloads and avoid mixing tenants until the patch is deployed.
Use mandatory access control (AppArmor or SELinux) profiles that constrain LXD daemon writes to expected directories.

bash

# Configuration example: restrict image import and instance edit to admins
lxc auth group permission add operators image can_create_projects=false
lxc config set core.trust_password ""
lxc project set default features.images=false