Vulnerability details
CVE-2026-87799
Canonical LXD
Arbitrary file write on LXD host via symlink in migration stream
CVSS 3.1
9.9Critical
Official description
Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client that can create instances or custom storage volumes in a project, or a malicious migration source server, to write attacker-controlled files to arbitrary paths on the target host as root, leading to full host compromise. The attacker does this with a crafted rsync or btrfs send stream that plants a symlink in the transferred volume, such as rootfs or root.img, and then writes through it.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.9Critical | 3.1 | CVEProject cvelistV5 (CNA) (canonical) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Canonical | LXD | 4.0.0 ≤ v < 4.0.14 | CVEProject cvelistV5 (CNA) |
| Canonical | LXD | 5.0.0 ≤ v < 5.0.10 | CVEProject cvelistV5 (CNA) |
| Canonical | LXD | 5.21.0 ≤ v < 5.21.8 | CVEProject cvelistV5 (CNA) |
| Canonical | LXD | 6.0 ≤ v < 6.10 | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-09-28
- Last updated
- 2026-09-29
- State
- Published
- Assigner (CNA)
- canonical
Exploit prediction (EPSS)
0.4%
Probability of exploitation in 30 days
35.2%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-59Improper link resolution before file access ('link following')