Link following in LXD - CVE-2026-63293
Published: August 1, 2026
Vulnerability identifier: #VU140675
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-63293
CWE-ID: CWE-59
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Affected software:
LXD
LXD
Detailed vulnerability description
The vulnerability allows a remote user to read and overwrite arbitrary files on the host as root.
The vulnerability exists due to improper link resolution in the metadata.yaml handling in the instance metadata API when processing a crafted image containing a metadata.yaml symlink and handling metadata GET or PUT requests. A remote user can import a crafted image and send metadata API requests to access the symlink target to read and overwrite arbitrary files on the host as root.
The issue can be exploited entirely through the daemon API without requiring a privileged container, a running workload, or a kernel exploit, and project-restricted users can trigger it.
How to mitigate CVE-2026-63293
Install security update from vendor's website.