Critical vulnerabilities found
Several critical and high impact vulnerabilities affecting LXD were identified and addressed. Some were identified directly by contributors, and some were referred to us from the Incus project, which were then confirmed to affect LXD as well.
The critical vulnerabilities, primarily related to insufficient path sanitization, input validation, and configuration bypasses, could allow authenticated users to achieve arbitrary file read/write operations or arbitrary command execution on the host system with root privileges.
All LXD users are urged to update to the latest version immediately to mitigate these risks.
Vulnerability summaries
1. Migration and backup import related symlink & path traversal attacks
Several vulnerabilities stem from how LXD handles migration and backup of instance and volume migrations.
- CVE-2026-85526 Path traversal via btrfs optimized-backup `subvolumes[].path` enables root file/dir manipulation
- CVE-2026-85185 btrfs optimized backup/migration: unvalidated subvolume path enables root arbitrary file delete/write (RCE ceiling)
- CVE-2026-87799 Arbitrary file write on host via symlink in migration stream
2. Client file or image download path traversal attacks
Improper handling of file downloads allow a malicious agent in a LXD VM or malicious image server to write files outside of the intended target directory.
- CVE-2026-87798 Malicious agent in a VM can escape the target directory of a recursive file pull
- CVE-2026-86334 CLI path traversal when exporting an image from a malicious server
3. Violation of project isolation
Two approaches to bypassing project isolation were discovered. These allow authenticated attackers with restricted permissions to gain access to resources in projects that they do not have access to.
- CVE-2026-86335 Restricted client can import a private image from another project
- CVE-2026-97335 Project restriction bypass for custom volume copy with omitted source type
Impact
These vulnerabilities significantly undermine the multi-tenant isolation guarantees of LXD.
Specifically:
-
Data Breach: Unauthorized access to and exfiltration of data from other tenants’ images and storage volumes.
-
Privilege Escalation: By manipulating migration and backup protocols, an authenticated attacker can achieve arbitrary host root execution, effectively breaking out of the sandboxed environment.
-
Client exposure: An attacker with root access to a LXD VM could cause arbitrary file write on a client machine, if the client attempts to pull files from the VM.
Fixed snap versions
| Channel | Snap Name | Fixed Version | Release date |
|---|---|---|---|
| 6/stable | lxd | 6.9 (re-spin) | 2026-09-24 |
| 5.21/stable | lxd | 5.21.8 | 2026-09-24 |
| 5.0/stable | lxd | 5.0.10 | 2026-09-24 |
| 4.0/stable | lxd | 4.0.14 | 2026-09-24 |
How to address
All users must update their LXD installations to the latest version available in their respective channels.
sudo snap refresh lxd
Acknowledgements
We would like to thank palkeo, manus-use, EclipsSec, unravel11 and stgraber for their reporting.