Critical vulnerabilities found
Several critical and high impact vulnerabilities affecting LXD were identified and addressed. Some were identified directly by contributors, and some were referred to us from the Incus project, which were then confirmed to affect LXD as well.
The critical vulnerabilities, primarily related to insufficient path sanitization, input validation, and configuration bypasses, could allow authenticated users to achieve arbitrary file read/write operations or arbitrary command execution on the host system with root privileges.
All LXD users are urged to update to the latest version immediately to mitigate these risks.
Vulnerability summaries
1. Image-related path traversal & symlink attacks
Several vulnerabilities stem from how LXD handles malicious instance or image files.
- CVE-2026-63293 Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root
- CVE-2026-63294 Root RCE via image backup.yaml symlink
- CVE-2026-16033 Prevent image metadata template to escape instance directory
- CVE-2026-66898 Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE
2. Argument injection in container configuration
An attacker can inject malicious arguments into the LXC container configuration, resulting in potential arbitrary command execution during container start operations.
3. Restricted project bypass
Several approaches to bypassing project restrictions were discovered. These allow attackers to gain access to the host by using privileged instance settings that are seldom allowed in restricted projects.
- CVE-2026-63295 Project restriction
restricted.containers.privilege=isolatedbypassable by omittingsecurity.idmap.isolated - CVE-2026-63296 Project restriction bypass via instance migration config override
- CVE-2026-63297 Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge
- CVE-2026-63299 Storage volume cross-project move and snapshot restore bypass project disk limits
- CVE-2026-62420 Cross-project cluster migration bypasses project restrictions via cluster notification flag
- CVE-2026-63300 Cross-project instance move bypasses all project restrictions allowing host command execution
Impact
These vulnerabilities significantly undermine the multi-tenant isolation guarantees of LXD.
Specifically:
-
Data Breach: Unauthorized access to and exfiltration of data from other tenants’ instances and custom volumes.
-
Privilege Escalation: By bypassing restricted project policies, an authenticated attacker can achieve arbitrary host root execution, effectively breaking out of the sandboxed environment.
-
Horizontal Movement: Attackers can move unauthorized data and instances across the infrastructure, facilitating further exploitation.
Fixed snap versions
| Channel | Snap Name | Fixed Version | Planned release date |
|---|---|---|---|
| 6/stable | lxd | 6.9 (re-spin) | 2026-07-31 |
| 5.21/stable | lxd | 5.21.6 | 2026-07-31 |
| 5.0/stable | lxd | 5.0.8 | 2026-07-31 |
| 4.0/stable | lxd | 4.0.12 | 2026-07-31 |
How to address
All users must update their LXD installations to the latest version available in their respective channels.
sudo snap refresh lxd
Acknowledgements
We would like to thank adamyordan, EclipsSec, babakizo420, Hye-Dev, manus-use, Mickey777777 and stgraber for their reporting.