CVE-2026-87799: Canonical LXD Path Traversal Vulnerability

CVE-2026-87799 Overview

Canonical LXD contains an improper link resolution vulnerability in its migration receive path. The flaw affects versions 4.0 and later on Linux, with fixes shipped in 4.0.14, 5.0.10, 5.21.8, and 6.10. An authenticated client with permission to create instances or custom storage volumes in a project can exploit the issue. A malicious migration source server can also trigger the flaw. Exploitation produces attacker-controlled file writes to arbitrary paths on the target host as root, resulting in full host compromise. The weakness is classified under CWE-59: Improper Link Resolution Before File Access.

Critical Impact
Authenticated attackers can plant a symlink inside a transferred volume and write through it to overwrite arbitrary files as root, taking over the LXD host.

Affected Products

Canonical LXD 4.0 through 4.0.13
Canonical LXD 5.0 through 5.0.9, 5.21 through 5.21.7
Canonical LXD 6.0 through 6.9 on Linux

Discovery Timeline

2026-09-28 - CVE-2026-87799 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-87799

Vulnerability Analysis

LXD supports live migration of instances and custom storage volumes between hosts. The receive-side logic unpacks a stream (such as rsync or btrfs send) into the destination volume path. The receiver does not safely resolve symbolic links contained in that stream before writing. When the stream includes a symlink named like rootfs or root.img, subsequent writes follow the link out of the destination directory. Because lxd runs as root on the host, those writes land on any attacker-chosen path with root privileges. An attacker who can create instances or custom storage volumes in any project satisfies the authentication requirement, and a hostile migration source server can perform the same attack against a victim target.

Root Cause

The migration receive path trusts filesystem entries delivered by the peer. It does not validate that path components resolve inside the intended destination before opening files for write. This is a classic [CWE-59] symlink-following defect in a privileged service that processes attacker-controlled archive-like streams.

Attack Vector

Exploitation requires network reachability to the LXD API or a migration endpoint. The attacker crafts an rsync or btrfs send stream containing a symlink entry under a well-known name such as rootfs or root.img, followed by file contents written to that same name. The LXD receiver resolves the symlink and writes the attacker-supplied contents to the target path on the host as root. Overwriting files such as /etc/shadow, /root/.ssh/authorized_keys, systemd unit files, or binaries in /usr/sbin yields full host compromise. The vendor advisory describes affected versions and fixes in the Canonical LXD GitHub Security Advisory GHSA-fmc3-3cpq-6whr.

No public proof-of-concept code is referenced in the advisory. The exploitation mechanism is described in prose above based on the published advisory details.

Detection Methods for CVE-2026-87799

Indicators of Compromise

Unexpected symlinks named rootfs, root.img, or similar inside volume directories under the LXD storage pool.
Root-owned writes to sensitive paths such as /etc/shadow, /etc/sudoers.d/, /root/.ssh/authorized_keys, or systemd units correlated in time with lxd migration activity.
Inbound migration connections to lxd from unexpected source hosts in the API or daemon logs.

Detection Strategies

Monitor the LXD daemon log (/var/log/lxd/lxd.log or journald unit snap.lxd.daemon) for migration receive events, especially those initiated by non-administrative project members.
Alert on file integrity changes to security-critical paths while the lxd process is the writing parent.
Baseline storage pool contents and flag symlinks whose targets resolve outside the owning volume directory.

Monitoring Recommendations

Enable auditd rules on /etc/shadow, /etc/passwd, /root/.ssh/, and /etc/systemd/system/ with the lxd executable as a correlation key.
Forward LXD and host audit telemetry to a central analytics platform and retain migration events for incident reconstruction.
Review project-level RBAC to identify every principal able to create instances or custom storage volumes.

How to Mitigate CVE-2026-87799

Immediate Actions Required

Upgrade LXD to 4.0.14, 5.0.10, 5.21.8, or 6.10 depending on your deployed branch.
Restrict project membership so that only trusted principals can create instances or custom storage volumes.
Block inbound migration from untrusted LXD source servers at the network layer until patched.

Patch Information

Canonical fixed the issue in LXD releases 4.0.14, 5.0.10, 5.21.8, and 6.10. Apply the update through your distribution package manager or the LXD snap channel that matches your deployed track. Full details are documented in the Canonical LXD GitHub Security Advisory GHSA-fmc3-3cpq-6whr.

Workarounds

Revoke can_create_instances and can_create_storage_volumes permissions from untrusted project members until the patch is deployed.
Disable or firewall the LXD migration listener and refuse connections from any source server you do not administer.
Audit existing custom storage volumes for pre-planted symlinks before upgrading to prevent carry-over exploitation.

bash

# Verify installed LXD version and upgrade via snap
lxd --version
sudo snap refresh lxd --channel=5.21/stable
# Restrict project permissions (example)
lxc auth group permission remove untrusted-group project default can_create_instances
lxc auth group permission remove untrusted-group project default can_create_storage_volumes