CVE-2026-63294

Executive Summary

CVE-2026-63294 is a critical link-following (CWE-59) vulnerability in LXD, the Linux container hypervisor/manager. The flaw resides in LXD's archive import and unpacking logic, where a crafted image or backup archive containing a symlinked backup.yaml file can cause LXD to process unconfined configuration metadata. An attacker with low-privileged network access can exploit this to execute arbitrary commands as root on the host system. Given a CVSS score of 9.9 and no available patch, this vulnerability presents an imminent and severe risk to any organization operating an LXD-based virtualization or container-hosting infrastructure.

Technical Analysis

The vulnerability is classified under CWE-59, "Improper Link Resolution Before File Access ('Link Following')". The core weakness involves LXD's failure to properly validate and confine the backup.yaml file when it is encountered as a symbolic link during archive import or unpacking operations.

Vulnerability Mechanism:

LXD supports the import of images and backup archives from remote or local sources. During the extraction process, LXD reads a metadata file named backup.yaml to determine configuration, container definitions, and various operational parameters. The flawed logic does not verify whether this file is a regular file or a symbolic link before dereferencing it.

An attacker crafts an archive (e.g., a tar file) where backup.yaml is a symbolic link pointing to an attacker-controlled destination or to a sensitive file on the host (e.g., /etc/crontab, /root/.ssh/authorized_keys, or a file containing executable directives). When LXD processes the archive, it follows the symlink and parses the content at the link target as if it were a legitimate backup.yaml.

Attack Surface:

• Network Attack Vector (AV:N): Exploitation is possible over the network. LXD exposes an API (typically on port 8443 for the REST API) that permits remote management tasks, including image import and backup restoration.
• Low Privilege Required (PR:L): An attacker only needs a valid account with permission to initiate an image import or backup restore operation. This is often delegated to regular users or lower-tier administrators in multi-tenant container environments.
• Scope Changed (S:C): The vulnerability impacts resources beyond the attacker's authorization level, specifically the host operating system, which sits outside the security boundary of the LXD-managed containers.
• High Confidentiality/Integrity/Availability (C:H/I:H/A:H): Full root compromise of the host leads to complete system takeover, data exfiltration, and service disruption.

Code-Level Explanation:

Insufficient technical detail available. The NVD description does not specify the exact code path, function names, or the validation checks that are bypassed. However, the class of vulnerability is well-understood: the archive extraction routine likely lacks a check such as lstat() to determine file type before calling open() or read(). A safe implementation would reject symbolic links (or any non-regular file) within the archive path corresponding to backup.yaml.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and the CVSS vector.

Step 1 — Reconnaissance / Target Identification: The attacker identifies an LXD host. This can be done by scanning for the LXD REST API endpoint on port 8443 or by other fingerprinting methods. The attacker then enumerates user accounts or compromises a low-privileged credential. They must identify an account that has permissions to initiate an image import or backup restore — permissions typically granted to container operators or delegates.

Step 2 — Flaw Trigger: The attacker crafts a malicious archive (e.g., a .tar or .tar.gz file) that is structured as a valid LXD image or backup. Inside the archive, the file backup.yaml is replaced with a symbolic link. The target of the symlink points to a file on the host that contains data that can be interpreted as LXD configuration directives or is a sensitive resource the attacker wants to manipulate.

Step 3 — Payload / Execution Method: The attacker initiates an archive import or restore operation via the LXD API (or CLI). LXD begins unpacking the archive. As it encounters the backup.yaml symlink, it follows it and reads the content at the link's destination. Because the content is parsed as unconfined configuration metadata, an attacker can inject directives that cause LXD to execute arbitrary commands. For example, the parsed YAML could reference user-defined hooks or storage-quota scripts that LXD executes with root privileges on the host.

Step 4 — Post-Exploitation Impact: Successful exploitation yields root-level code execution on the host system. The attacker can:

• Install persistence mechanisms (e.g., cron jobs, systemd services, SSH keys).
• Exfiltrate sensitive data from the host and all containers running on it.
• Pivot laterally to other network resources accessible from the host.
• Disrupt or destroy the container host, impacting all tenants.

Given the network vector and the scope change, this is a severe supply-chain-style risk for any infrastructure relying on LXD.

Impact Assessment

Affected Systems: All LXD installations that accept image imports or backup restores from untrusted users or networks are vulnerable. This includes multi-tenant container platform providers, private cloud environments, and edge/on-premises virtualization clusters.

Business Impact:

• Confidentiality (C:H): Complete compromise of host data, including secrets, application data of all containers, and potentially credentials for connected networks.
• Integrity (I:H): Attacker can modify any file on the host, alter container images, inject backdoors, and manipulate system state.
• Availability (A:H): Attacker can shut down the host, delete data, or create a denial-of-service condition for all running containers.

Blast Radius: The CVSS scope (S:C) indicates that the impact extends beyond the container tenant. In a multi-tenant environment, a single low-privileged attacker can pivot from their own container or management role to compromise the physical host and, subsequently, all other tenants. This is a maximum-impact scenario for container isolation failures.

CVSS Subscores (Inferred):

• Attack Vector: Network (N)
• Attack Complexity: Low (L)
• Privileges Required: Low (L)
• User Interaction: None (N)
• Scope: Changed (C)

Detection Guidance

Detection of this vulnerability is challenging because the malicious action occurs during archive parsing, which may not trigger typical network signature detections. However, anomalous file system behavior and process execution patterns can be identified.

Sigma Rule

title: LXD Backup YAML Symlink Exploitation
id: a1b2c3d4-1234-5678-9abc-def012345678
status: experimental
description: Detects LXD processes accessing suspicious symbolic links during archive import or restore operations.
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/lxd'
        CommandLine|contains:
            - 'import'
            - 'restore'
            - 'backup'
        CommandLine|contains: 'backup.yaml'
    filter:
        CommandLine|contains: 'symlink'
    condition: selection and not filter
level: critical
falsepositives:
    - Legitimate administrative restore operations in development environments.
tags:
    - attack.privilege_escalation
    - attack.t1068
    - cve.2026-63294

YARA Rule

rule LXD_Backup_Symlink_Exploit
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects malformed LXD backup archives containing a backup.yaml symlink"
        date = "2026-01-01"
        cve = "CVE-2026-63294"
    strings:
        $tar_magic = { 75 73 74 61 72 } // 'ustar' at offset 257
        $yaml_name = "backup.yaml"
        $symlink_marker = { 32 2C 00 } // '2' typeflag for symlink in tar header
    condition:
        $tar_magic at 257 and $yaml_name and $symlink_marker
}

Suricata IDS Rule

alert http any any -> any any (msg:"LXD Backup Import Attempt - Potential CVE-2026-63294 Exploitation"; flow:to_server; http.uri; content:"/1.0/images"; nocase; http.method; content:"POST"; nocase; file.data; content:"backup.yaml"; nocase; sid:202663294; rev:1; metadata:cve CVE-2026-63294;)

Elastic Detection

process where event.type == "start" and process.name == "lxd" and
  process.args in ("import", "restore", "backup") and
  process.args == "backup.yaml" and
  not process.args == "*.tar"

Splunk SPL Query

index=linux sourcetype=process_creation
| search process_name=lxd
| search process_arguments IN ("*import*", "*restore*", "*backup*")
| search process_arguments="*backup.yaml*"
| search NOT process_arguments="*--no-symlink*"
| stats count by host, user, process_arguments
| where count > 0

Wazuh OSSEC Rule

<group name="cve-2026-63294,">
  <rule id="202663" level="12">
    <if_sid>5710</if_sid>
    <field name="audit.command">^import$|^restore$|^backup$</field>
    <field name="audit.command">backup\.yaml</field>
    <description>LXD import/backup operation referencing backup.yaml - potential CVE-2026-63294 exploitation</description>
    <group>LXD,vulnerability,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. The vendor has not released a fix, and no workarounds from the vendor are documented.

Immediate Mitigations (without a patch):

1. Restrict Network Access: If the LXD API does not need to be exposed externally, block inbound connections to port 8443 from untrusted networks via firewall rules.
2. Enforce Least Privilege: Review the LXD access control lists (ACLs) and group permissions. Remove import permissions from all users except a minimal set of trusted administrators.
3. Disable Image Import / Backup Restore: If not essential to your operations, temporarily disable the import and restore functionalities via LXD configuration (e.g., setting core.https_address to localhost only) to reduce the attack surface.
4. Monitor File Integrity: Deploy File Integrity Monitoring (FIM) on the LXD host to detect unexpected changes to critical system files or the creation of new cron jobs/user accounts.

Patch/Upgrade Steps:

• Currently unavailable. Continuously monitor the LXD project's official channels (GitHub repository, mailing lists, security advisories) for a patched release.
• Until a patch is released, treat all LXD imports and restores as high-risk operations requiring manual security review.

Long-term Hardening:

• Run LXD inside a restricted namespace or as a non-root user where feasible, despite it typically requiring root.
• Separate the management plane from the data plane; use API access controls and TLS client certificates to restrict API access to a small set of trusted clients.
• Implement an application-level firewall or WAF that can inspect the HTTP API traffic for suspicious archive uploads.
• Regularly audit user accounts with LXD management roles and ensure they are necessary.

References

Given the provided data, no specific references are included. However, the following authoritative sources should be monitored for updates:

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-63294
2. LXD Project (GitHub): https://github.com/canonical/lxd — Monitor for security advisories and patched releases.
3. Canonical Security Notices: https://ubuntu.com/security/notices — For potential LXD security updates.
4. CWE-59 Detail: https://cwe.mitre.org/data/definitions/59.html — For the vulnerability class.
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-63294 is not listed, but should be re-checked periodically.

No threat actor campaigns or exploit-in-the-wild evidence has been identified for CVE-2026-63294 at the time of writing. However, given the high CVSS score and network attack vector, active exploitation attempts are highly probable once public exploit code is released.