CVE-2026-87799

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-87799
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87799.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-87799
Aliases
  • GHSA-fmc3-3cpq-6whr
Downstream
Published
2026-09-28T13:22:29Z
Modified
2026-09-30T03:47:28Z
Severity
  • 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Arbitrary file write on LXD host via symlink in migration stream
Details

Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client that can create instances or custom storage volumes in a project, or a malicious migration source server, to write attacker-controlled files to arbitrary paths on the target host as root, leading to full host compromise. The attacker does this with a crafted rsync or btrfs send stream that plants a symlink in the transferred volume, such as rootfs or root.img, and then writes through it.

Database specific 
{
    "cna_assigner":  "canonical",
    "cwe_ids":  [
        "CWE-59"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87799.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "6.0"
                },
                {
                    "fixed":  "6.10"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/canonical/lxd

Affected ranges

Type
GIT
Repo
https://github.com/canonical/lxd
Events
Introduced
03aab09f5b5cbdada00c6539877dcf5932fcde98
Fixed
b6e6806eef1ffb9be88d80af840f82d762ba1e38
Introduced
1e1349e3cbf30c1b2ce74e531d4dd0fd52c45be1
Fixed
6dbdad8c58bbabc680340c61d238255cccece068
Introduced
761d134ceabd306f57acfb0ca51f59b03751a5b0
Fixed
a60b9e26b2e4b8a3353e29d8be45eb623ad16ead
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "4.0.0"
        },
        {
            "fixed":  "4.0.14"
        },
        {
            "introduced":  "5.0.0"
        },
        {
            "fixed":  "5.0.10"
        },
        {
            "introduced":  "5.21.0"
        },
        {
            "fixed":  "5.21.8"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

lxd-4.*
lxd-4.0.0
lxd-4.0.1
lxd-4.0.11
lxd-4.0.12
lxd-4.0.13
lxd-4.0.2
lxd-4.0.3
lxd-4.0.4
lxd-4.0.5
lxd-4.0.6
lxd-4.0.7
lxd-4.0.8
lxd-4.0.9
lxd-5.*
lxd-5.0.0
lxd-5.0.1
lxd-5.0.2
lxd-5.0.7
lxd-5.0.8
lxd-5.0.9
lxd-5.1
lxd-5.10
lxd-5.11
lxd-5.12
lxd-5.13
lxd-5.14
lxd-5.15
lxd-5.16
lxd-5.17
lxd-5.2
lxd-5.21.5
lxd-5.21.6
lxd-5.21.7
lxd-5.3
lxd-5.4
lxd-5.5
lxd-5.6
lxd-5.7
lxd-5.8
lxd-5.9
Other
show

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87799.json"