LXD 4.0+ Improper Link Resolution in Migration Receive Path (Host Compromise)
CVE-2026-87799 Published on September 28, 2026
Arbitrary file write on LXD host via symlink in migration stream
Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client that can create instances or custom storage volumes in a project, or a malicious migration source server, to write attacker-controlled files to arbitrary paths on the target host as root, leading to full host compromise. The attacker does this with a crafted rsync or btrfs send stream that plants a symlink in the transferred volume, such as rootfs or root.img, and then writes through it.
Vulnerability Analysis
CVE-2026-87799 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Weakness Type
What is an insecure temporary file Vulnerability?
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVE-2026-87799 has been classified to as an insecure temporary file vulnerability or weakness.
Products Associated with CVE-2026-87799
Want to know whenever a new CVE is published for Canonical Lxd? stack.watch will email you.
Affected Versions
Canonical LXD:- Version 4.0.0 and below 4.0.14 is affected.
- Version 5.0.0 and below 5.0.10 is affected.
- Version 5.21.0 and below 5.21.8 is affected.
- Version 6.0 and below 6.10 is affected.