Critical vulnerabilities found
Several critical and high impact vulnerabilities affecting LXD were identified and addressed. Some were identified directly by contributors, and some were referred to us from the Incus project, which were then confirmed to affect LXD as well.
The critical vulnerabilities, primarily related to insufficient path sanitization, input validation, and configuration bypasses, could allow authenticated users to achieve arbitrary file read/write operations or arbitrary command execution on the host system with root privileges.
All LXD users are urged to update to the latest version immediately to mitigate these risks.
Vulnerability summaries
1. Image-related path traversal & symlink attacks
Several vulnerabilities stem from how LXD handles malicious instance images or image server responses:
- CVE-2026-48750 (Arbitrary file write on host via
exec-outputsymlink in crafted image ) - CVE-2026-48752 (Arbitrary file read+write on host via templates/ symlink in malicious image)
- CVE-2026-48749 (Arbitrary file read+write on host via rootfs/ symlink in malicious image)
- CVE-2026-48769 (Arbitrary file write on client due to trusted image hash)
2. Argument injection in backup compression
LXD’s backup system validates the first token of the compression algorithm (e.g., zstd) against an allowlist but fails to sanitize subsequent arguments. An attacker can inject malicious flags (such as -o for output paths), resulting in arbitrary file writes and potential command execution during backup operations.
3. Restricted project bypass
Several approaches to bypassing project restrictions were discovered. These allow attackers to gain access to the host by using privileged instance settings that are seldom allowed in restricted projects.
- CVE-2026-9640 (Backup snapshot import bypasses project restrictions)
- CVE-2026-48751 (Restricted project bypass leading to arbitrary command execution)
- CVE-2026-55622 (Project restriction bypass in instance copy across projects)
- CVE-2026-55621 (Project restriction bypass for custom volume copy across projects)
4. Instance access to custom volumes through missing authorization check
Any guest in a project with security.devlxd.management.volumes enabled can attach a volume belonging to a different guest by naming it in a device PATCH, giving one tenant full read and write access to another tenant’s volume data.
Impact
These vulnerabilities significantly undermine the multi-tenant isolation guarantees of LXD.
Specifically:
-
Data Breach: Unauthorized access to and exfiltration of data from other tenants’ instances and custom volumes.
-
Privilege Escalation: By bypassing restricted project policies, an authenticated attacker can achieve arbitrary host root execution, effectively breaking out of the sandboxed environment.
-
Horizontal Movement: Attackers can move unauthorized data and instances across the infrastructure, facilitating further exploitation.
Fixed snap versions
| Channel | Snap Name | Fixed Version | Planned release date |
|---|---|---|---|
| 6/stable | lxd | 6.9 | 2026-06-26 |
| 5.21/stable | lxd | 5.21.5 | 2026-07-03 |
| 5.0/stable | lxd | 5.0.7 | 2026-07-03 |
| 4.0/stable | lxd | 4.0.11 | 2026-07-03 |
How to address
All users must update their LXD installations to the latest version available in their respective channels.
sudo snap refresh lxd
If you are running an LTS series that does not yet have a fix release available, then until that time, a mitigation to these vulnerabilities is to disable non-admin users from accessing the LXD API.
Acknowledgements
We would like to thank antifob, stgraber, larrasket and mpurg for their reporting.