CVE-2026-87798: Canonical LXD Path Traversal Vulnerability

CVE-2026-87798 Overview

CVE-2026-87798 is an improper link resolution vulnerability [CWE-59] in the recursive file pull feature of the Canonical LXD command-line interface (CLI) client. The flaw affects Canonical LXD versions 4.0.2 through 6.9 on Linux and is fixed in versions 4.0.14, 5.0.10, and 5.21.8. An attacker with root access inside a guest virtual machine can supply a modified lxd-agent that returns inconsistent SFTP directory listings and Lstat results. When an operator performs a recursive file pull, the LXD client writes attacker-controlled files or directory trees to arbitrary paths on the client host under the operator's privileges.

Critical Impact
A compromised VM guest can write arbitrary files to the host operating the LXD CLI, enabling host-side integrity compromise with the operator's privileges.

Affected Products

Canonical LXD versions 4.0.2 through 4.0.13 (fixed in 4.0.14)
Canonical LXD 5.x series up to 5.0.9 and 5.21.x up to 5.21.7 (fixed in 5.0.10 and 5.21.8)
Canonical LXD 6.x series up to 6.9

Discovery Timeline

2026-09-28 - CVE CVE-2026-87798 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-87798

Vulnerability Analysis

The LXD CLI client exposes a recursive file pull operation that copies files from a guest instance to the operator's host. The transfer relies on SFTP responses from the lxd-agent process running inside the guest. The client trusts both the directory listings and the Lstat metadata the agent returns when deciding how to resolve and recreate paths on the host. An attacker who controls the guest can replace the agent with a modified binary that produces mismatched listings and stat results. The inconsistency allows symbolic links to be interpreted as regular directories, and the client follows attacker-chosen targets while writing files outside the intended destination directory.

Root Cause

The root cause is improper link resolution during recursive extraction. The client does not atomically verify that each path component resolves within the chosen output directory before writing. Because the guest-side agent is treated as a trustworthy metadata source, a hostile agent can lie about file types between the listing and stat phases, producing a time-of-check versus time-of-use condition for symbolic link handling.

Attack Vector

Exploitation requires an attacker with root privileges inside an LXD-managed virtual machine and an operator who initiates a recursive file pull against that instance using the vulnerable CLI. The attacker replaces or modifies the lxd-agent to return crafted SFTP responses. When the operator runs lxc file pull --recursive, the modified responses redirect writes to arbitrary paths on the host filesystem, with the operator's user privileges. Successful exploitation yields high integrity impact without disclosing data or disrupting availability. See the GitHub Security Advisory GHSA-mr8v-hx34-hfvf for additional technical context.

Detection Methods for CVE-2026-87798

Indicators of Compromise

Unexpected files or directories appearing on an operator workstation shortly after an lxc file pull --recursive command targeting an untrusted guest.
Modifications to operator-owned configuration files such as ~/.ssh/authorized_keys, ~/.bashrc, or ~/.config entries that coincide with LXD pull activity.
lxd-agent binaries inside guest VMs whose hashes do not match the distribution-shipped version.

Detection Strategies

Audit shell history and command telemetry for recursive pull operations issued against guest instances that are not fully trusted.
Compare the file layout written by a pull against the expected guest source tree to identify writes outside the destination directory.
Monitor for symbolic links in guest filesystems that reference sensitive paths such as /etc, /root, or operator home directories.

Monitoring Recommendations

Enable filesystem auditing with auditd on operator hosts for writes under home directories and /etc triggered by the lxc process.
Alert on execution of lxc file pull with the --recursive flag against production or shared guest instances.
Record and review integrity hashes of lxd-agent binaries inside managed guests as part of baseline configuration monitoring.

How to Mitigate CVE-2026-87798

Immediate Actions Required

Upgrade the LXD client to version 4.0.14, 5.0.10, 5.21.8, or later depending on the deployed release train.
Avoid recursive file pulls from guest instances that are administered by untrusted parties until the client is patched.
Run the LXD CLI from an unprivileged account dedicated to administration to limit the blast radius of arbitrary file writes.

Patch Information

Canonical has published fixes in LXD 4.0.14, 5.0.10, and 5.21.8. Operators running LXD 6.x releases up to 6.9 should install the latest available point release that includes the backport. Full remediation details are provided in the Canonical LXD Security Advisory GHSA-mr8v-hx34-hfvf.

Workarounds

Replace recursive pulls with per-file transfers using lxc file pull <instance>/<path> <dest> for specific known files.
Pull data into an empty, dedicated directory and inspect the resulting tree before relocating files to sensitive paths.
Use lxc exec to create a tar archive inside the guest and transfer the single archive, extracting it on the host with tooling that rejects symlink traversal.

bash

# Verify installed LXD version and upgrade on a snap-based system
lxc version
sudo snap refresh lxd --channel=5.21/stable

# Safer alternative to recursive pull: archive inside the guest
lxc exec my-instance -- tar --one-file-system -cf /tmp/data.tar /srv/data
lxc file pull my-instance/tmp/data.tar ./data.tar
mkdir ./extract && tar -xf ./data.tar -C ./extract