SB2026080112 - Multiple vulnerabilities in LXD

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080112

SB2026080112 - Multiple vulnerabilities in LXD

Published: August 1, 2026

Security Bulletin ID SB2026080112
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 11
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 91% Low 9%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 11 vulnerabilities.


1) Path traversal (CVE-ID: CVE-2026-66898)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to path traversal in createFromBackup during instance backup restore when processing an application/octet-stream instance backup import request. A remote user can supply a crafted backup tarball with a traversal sequence in backup/index.yaml to execute arbitrary code.

The issue is reachable through POST /1.0/instances, and snapshot names in the backup metadata are described as a second identical vector.


2) Path traversal (CVE-ID: CVE-2026-16033)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to read arbitrary host files and create root-owned files on the host.

The vulnerability exists due to path traversal in the QEMU/VM template path in driver_qemu.go templateApplyNow when processing attacker-controlled template paths from custom VM images or restored VM backups. A remote user can supply crafted metadata.yaml template entries to read arbitrary host files and create root-owned .out files on the host.

The created host file is forced to use a .out suffix, and the file-read result is disclosed into the guest through the VM config drive.


3) Link following (CVE-ID: CVE-2026-63293)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to read and overwrite arbitrary files on the host as root.

The vulnerability exists due to improper link resolution in the metadata.yaml handling in the instance metadata API when processing a crafted image containing a metadata.yaml symlink and handling metadata GET or PUT requests. A remote user can import a crafted image and send metadata API requests to access the symlink target to read and overwrite arbitrary files on the host as root.

The issue can be exploited entirely through the daemon API without requiring a privileged container, a running workload, or a kernel exploit, and project-restricted users can trigger it.


4) Link following (CVE-ID: CVE-2026-63294)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code as root on the host.

The vulnerability exists due to improper link resolution in backup file handling in the image metadata unpacking and instance backup.yaml write logic when importing a crafted image and creating an instance from it. A remote user can supply an image containing a symlinked backup.yaml to overwrite a host file and execute arbitrary code as root on the host.

Exploitation requires image and instance creation rights in a project-confined environment, or an administrator to import or create an instance from an untrusted image.


5) Improper access control (CVE-ID: CVE-2026-63295)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper access control in the project restriction enforcement for restricted.containers.privilege and security.idmap.isolated when creating or updating containers and profiles with the security.idmap.isolated key omitted. A remote user can omit the security.idmap.isolated setting to obtain a non-isolated container and cause a denial of service.

The issue affects restriction checks routed through checkRestrictions, and the omitted key is treated by the runtime as the default non-isolated state.


6) Improper access control (CVE-ID: CVE-2026-63296)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code on the host as root.

The vulnerability exists due to improper access control in the instance migration handler when applying user-supplied configuration overrides during cross-member instance migration. A remote user can send a specially crafted instance migration request to execute arbitrary code on the host as root.

Exploitation requires a clustered deployment with 2 or more members and an instance in a restricted project.


7) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-63297)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to bypass project restrictions and achieve host escape.

The vulnerability exists due to a time-of-check time-of-use race condition in cross-project instance copy handling in cmd/incusd/instances_post.go when copying an instance across projects and merging source configuration after restriction validation. A remote user can send a crafted instance copy request to bypass project restrictions and achieve host escape.

Exploitation requires the ability to view a source instance in a less-restricted project and create instances in a restricted target project, and the source instance must contain dangerous configuration such as security.privileged, raw.lxc, or raw.apparmor.


8) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: CVE-2026-63298)

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code on the host.

The vulnerability exists due to improper neutralization of special elements in output in the nvidia.driver.capabilities instance configuration handling when writing user-supplied configuration values to lxc.conf. A remote user can inject a newline character into the configuration value to inject arbitrary LXC configuration directives and execute arbitrary code on the host.

Exploitation requires permission to set instance configuration, and injected directives are processed when the container starts.


9) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-63299)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in storagePoolVolumeTypePostMove and volume snapshot restore handling when moving storage volumes across projects or restoring snapshots. A remote user can move a large volume into a quota-limited project or restore a snapshot that exceeds current project limits to cause a denial of service.

This affects multi-tenant environments that rely on project disk quotas.


10) Incorrect authorization (CVE-ID: CVE-2026-62420)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary commands as root on the host.

The vulnerability exists due to incorrect authorization in cross-project cluster migration handling in POST /1.0/instances/{name} when processing a cross-project instance move to a different cluster member with migration enabled and the cluster notification flag set. A remote user can move an instance with restricted configuration keys into a restricted target project to execute arbitrary commands as root on the host.

Exploitation requires project-level access that allows instance creation in an unrestricted project and can_create_instances permission on the restricted target project. No start-time restriction re-validation occurs after the move.


11) Missing Authorization (CVE-ID: CVE-2026-63300)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code on the host.

The vulnerability exists due to missing authorization in instancePostMigration when moving an instance between projects on the same cluster member without validating the instance configuration against the target project's restrictions. A remote user can move a crafted instance from an unrestricted project to a restricted project to execute arbitrary code on the host.

The issue affects cross-project moves performed without the ?target= parameter, and exploitation can occur when the moved instance is later started.


Remediation

Install update from vendor's website.

References