CVE-2026-63294

Awaiting Analysis Awaiting Analysis - Queue

Link Following Flaw in LXD Permits Root Command Execution

Publication date: 2026-08-12

Last updated on: 2026-08-28

Assigner: Canonical Ltd.

Description

A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can exploit this flaw by providing a malicious archive with a symlinked backup.yaml file, causing LXD to process unconfined configuration metadata and execute arbitrary commands with root privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-28

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-63294

EUVD

EUVD-2026-57538

Affected Vendors & Products

Vendor	Product	Version / Range
ubuntu	lxd	*
canonical	lxd	From 4.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

CVE-2026-63294 is a critical link following vulnerability in LXD that allows an attacker to execute arbitrary commands with root privileges on the host system. It occurs when LXD processes crafted image or backup archives containing a symbolic link named backup.yaml pointing to a host file. LXD fails to properly validate this symlink, causing it to follow the link and process unconfined configuration metadata, leading to root command execution.

Detection Guidance

To detect this vulnerability, check if your LXD version is affected by running: lxd --version. Compare the output against patched versions (4.0.12, 5.0.8, 5.21.6, 6.10). Additionally, review system logs for unusual activity during image imports or backups, such as unexpected file writes to sensitive locations like /etc/ld.so.preload.

Impact Analysis

This vulnerability allows an attacker with image and instance creation rights to escalate privileges to root on the host system. They can execute arbitrary code, install malware, steal data, or take full control of the system. Attackers can also manipulate system files like /etc/ld.so.preload to maintain persistence or escalate the attack further.

Compliance Impact

This vulnerability can lead to severe compliance violations under GDPR and HIPAA due to unauthorized root access and potential data breaches. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A successful exploit could result in unauthorized data access, triggering mandatory breach notifications and significant fines.

Mitigation Strategies

Immediately update LXD to a patched version (4.0.12, 5.0.8, 5.21.6, or 6.10) using your package manager. Avoid importing untrusted images or backups. Restrict user permissions to prevent unauthorized image creation. Monitor for signs of compromise, such as unexpected changes to system files.

Hi! I’m here to help you understand CVE-2026-63294. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70