CVE-2026-87799: canonical lxd Link Following
Vulnerability summary
CVE-2026-87799 is a critical (CVSS 9.9) Link Following vulnerability in canonical lxd. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 33.7% of scored vulnerabilities.
Timeline
- 28-09-2026PublishedVulnerability first disclosed.
- 29-09-2026Last modifiedVulnerability information updated.
Description
Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client that can create instances or custom storage volumes in a project, or a malicious migration source server, to write attacker-controlled files to arbitrary paths on the target host as root, leading to full host compromise. The attacker does this with a crafted rsync or btrfs send stream that plants a symlink in the transferred volume, such as rootfs or root.img, and then writes through it.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated9.9CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.9CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- NVDNIST9.9CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.41%
Chance of exploitation in the next 30 days
Percentile
34%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Canonical1 product
- lxd≥ 4.0.0, < 4.0.14 | ≥ 5.0.0, < 5.0.10 | ≥ 5.21.0, < 5.21.8 | ≥ 6.0, < 6.10
Debian1 product
- lxdAll versions (No fix recorded)
Ubuntu1 product
- lxdAll versions (No fix recorded)
3 vendors · 3 products
