CVE-2026-87798
Deferred Deferred - Pending Action

Improper Link Resolution in Canonical LXD CLI Client

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: Canonical Ltd.

Description
Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 (fixed in 4.0.14, 5.0.10 and 5.21.8) on Linux allows an attacker with root access inside a virtual machine to write attacker-controlled files or directory trees to arbitrary paths on the client host, with the operator's privileges. The attacker does this by using a modified lxd-agent that returns inconsistent SFTP directory listings and Lstat results.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-87798
EUVD
EUVD-2026-88261

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
canonical lxd From 4.0.2 (inc) to 6.9 (inc)
canonical lxd to 6.9 (inc)
canonical lxd 4.0.14
canonical lxd 5.0.10
canonical lxd 5.21.8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper link resolution in the recursive file pull feature of the LXD CLI client. An attacker with root access inside a virtual machine can exploit it by using a modified lxd-agent that returns inconsistent SFTP directory listings and Lstat results. This allows the attacker to write files or directories to arbitrary paths on the client host with the operator's privileges.

Detection Guidance

Detecting this vulnerability requires checking the installed version of LXD on your system. Run 'lxd --version' to see the version. If it falls between 4.0.2 and 6.9, the system is vulnerable. Additionally, monitor for unusual file operations or symlink creation in directories where recursive file pulls are performed.

Impact Analysis

An attacker could overwrite critical system files like /etc/shadow or /root/.ssh/authorized_keys if the command is run as root. This could lead to system compromise, unauthorized access, or denial of service. The impact depends on the privileges of the user running the LXD client.

Compliance Impact

This vulnerability could lead to unauthorized file access or modification, potentially violating data integrity and confidentiality requirements in GDPR and HIPAA. Organizations using affected LXD versions may face compliance risks if exploited.

Mitigation Strategies

Immediately update LXD to a patched version (4.0.14, 5.0.10, or 5.21.8 or later). Avoid running recursive file pulls from untrusted virtual machines. If updates are not possible, restrict file pull operations to trusted sources and execute commands as an unprivileged user.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87798. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart