CVE-2026-66898

Executive Summary

CVE-2026-66898 is a critical path traversal vulnerability (CWE-22) affecting LXD, the system container and virtual machine manager. The flaw resides in backup import and restore functionality where LXD fails to validate instance and storage volume names within archive metadata. An authenticated attacker can craft a malicious backup archive with path traversal sequences to write files outside the designated restore directory, enabling arbitrary file overwrite or read on the host system. With a CVSS score of 9.9, this vulnerability allows an attacker with low privileges to achieve full system compromise while bypassing network boundaries through the management API. As of this report, no vendor patch exists, and exploitation potential is considered high given the straightforward nature of modified archive metadata.

Technical Analysis

The vulnerability lies in LXD's backup import and restore mechanism. LXD supports backing up instances and storage volumes into archive files that contain metadata describing the structure of the backup. During import or restore operations, LXD processes this metadata to reconstruct the instance or volume. The core flaw is the absence of input validation on instance names and storage volume names extracted from the archive metadata.

Vulnerability Mechanism. The path traversal vulnerability occurs when LXD constructs filesystem paths using attacker-controlled names. The archive metadata contains fields describing the instance or volume identifiers. LXD concatenates these identifiers into path strings for file operations, such as writing configuration files or volume data. Because the identifiers are not sanitized or normalized before use, a name containing ../ sequences causes LXD to resolve paths outside the intended restore directory. For example, an instance name like ../../etc/cron.d/backdoor would cause LXD to write a file to a location under /etc/cron.d/ on the host, depending on how the path is constructed.

Attack Surface. The attack surface is the LXD management daemon, typically exposed via a UNIX socket for local access and optionally over the network via a REST API (HTTPS, default port 8443). API access requires authentication and privileges to perform backup import operations. The intrinsic trust in archive contents means that validation of filenames is either absent or insufficient. The attacker supplies a tar-format backup archive containing a metadata.yaml file (or similar manifest) that specifies instance and volume names. These names are used verbatim in path operations during extraction and restore.

Code-Level Context. While specific function names are not disclosed in the advisory, the vulnerability pattern is consistent with insecure deserialization of backup manifests in container management systems. The operation sequence is:

1. Parse archive metadata to obtain list of instances/volumes.
2. For each entry, create directory or write file at a path derived from the name.
3. If name contains .., path normalization escapes the target base directory.

The lack of checks such as filepath.Clean() verification against the base directory, or rejection of paths containing .., permits the traversal.

CWE-22 Classification. The vulnerability aligns with CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). CVSS vector reflects network accessibility, low attack complexity, requirement of low privileges, no user interaction, and scope change indicating impact beyond the vulnerable component.

Exploitation Scenarios

The attack chain for this vulnerability is as follows:

1) Reconnaissance and Target Identification. The attacker first identifies LXD installations exposed via the network API or accessible through a compromised low-privilege account. Discovery can be performed by scanning for port 8443/TCP (LXD REST API) or by checking for the presence of the LXD daemon on multi-user systems. The attacker needs valid credentials with rights to invoke backup import/restore operations — this could be a compromised sudo user, a member of the lxd group (which has effective root access via socket), or a cloud tenant with access to a management interface.

2) Triggering the Flaw. The attacker creates a crafted backup archive, typically a tar archive containing a manifest file (e.g., metadata.yaml) and any supporting data files. The manifest declares an instance name or storage volume name containing path traversal sequences, such as ../../../../tmp/pwned. The attacker submits this archive via the backup import API endpoint or the command-line interface (lxc import command). LXD parses the manifest and extracts the archive contents, using the malicious names to construct filesystem paths.

3) Payload Execution at Vulnerability-Class Level. During extraction, LXD performs write operations for the declared instance/volume. Because the name contains .., the resulting path escapes the designated /var/lib/lxd/containers/ or /var/lib/lxd/storage-pools/ base directory. The attacker aims to place a payload in a location that yields code execution on the host. Common targets include:

• /etc/cron.d/<file> — scheduled job execution as root.
• /etc/ld.so.preload — library preloading for privilege escalation.
• /home/<user>/.ssh/authorized_keys — SSH key injection for persistent access.
• Systemd unit files under /etc/systemd/system/ triggering service execution.

The attacker can also leverage file read behavior to exfiltrate sensitive host files by redirecting a volume export path to a sensitive location.

4) Post-Exploitation Impact. Achieving arbitrary file write as root enables complete compromise of the host system. The attacker can establish persistence, disable security controls, loot credentials, and pivot to other systems on the network. The scope change (S:C) in the CVSS vector indicates that the impact extends beyond the LXD component itself, affecting the underlying operating system and connected infrastructure.

Note: No public PoC is available for this vulnerability. The attack chain is inferred from the vulnerability class (path traversal in backup restore) and standard exploitation techniques for such flaws.

Impact Assessment

Business Impact. Successful exploitation results in complete loss of confidentiality, integrity, and availability across both the LXD host and its tenants. Arbitrary file write as root translates to full code execution, allowing an attacker to:

• Read and exfiltrate any data stored on the host or in any container/VM managed by LXD.
• Modify system binaries, configuration, or persistent data.
• Deny service to all workloads by corrupting host files or crashing the daemon.

Affected Systems. Any environment using LXD for container or VM orchestration is affected, including:

• On-premises private clouds using LXD as a hypervisor.
• Developer workstations running LXD for test environments.
• CI/CD pipelines leveraging LXD for build isolation.
• Cloud providers offering LXD as a container platform.

Blast Radius. The CVSS vector subscores reflect the severity: Confidentiality Impact: High, Integrity Impact: High, Availability Impact: High. The Scope Changed (S:C) rating indicates that a single exploit compromises not just the LXD daemon but the host OS and all workloads residing on it — this represents cross-tenant compromise in multi-tenant environments. The low privilege requirement (PR:L) transforms any low-privileged user or compromised account into total compromise.

Detection Guidance

The following detection content focuses on identifying anomalous backup import activity, unusual path traversal patterns, and unexpected file writes. In the absence of public exploitation patterns, these rules target the core indicators of the attack.

Sigma Rule

title: LXD Backup Import Path Traversal Attempt
id: 8b4f2c1e-5a9d-4e7b-8c3f-2d1e6a9b4c7d
status: experimental
description: Detects attempts to import LXD backup archives containing path traversal sequences in instance or volume names.
logsource:
    product: linux
    category: process_creation
detection:
    selection_import:
        Image|endswith: 'lxc'
        CommandLine|contains:
            - 'import'
            - 'restore'
    selection_traversal:
        CommandLine|contains:
            - '../'
            - '..%2f'
            - '%2e%2e%2f'
    condition: selection_import and selection_traversal
level: high
falsepositives:
    - Legitimate use of relative paths in custom backup scripts (rare)
tags:
    - attack.t1190
    - cve.2026-66898

YARA Rule

rule LXD_Backup_Path_Traversal
{
    meta:
        author = "valtersit.com Threat Intel"
        description = "Detects LXD backup archive metadata containing path traversal sequences"
        cve = "CVE-2026-66898"
        date = "2026-01-01"
    strings:
        $traversal1 = "../" ascii
        $traversal2 = "..\\" ascii
        $traversal3 = "..%2f" ascii
        $traversal4 = "..%5c" ascii
        $lxd_metadata = "name:" ascii nocase
        $lxd_volume = "volume" ascii nocase
        $lxd_instance = "instance" ascii nocase
    condition:
        uint32(0) == 0x2E2E2F or
        any of ($traversal*) and any of ($lxd_*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-66898 LXD Backup Path Traversal Attempt"; flow:to_server,established; content:"lxd"; http.uri; nocase; content:"import"; http.uri; nocase; pcre:"/(?:\.\.\/|\.\.%2f|%2e%2e%2f)/i"; reference:cve,2026-66898; classtype:attempted-admin; sid:20266689801; rev:1;)

Elastic Detection

sequence by host.name
  [ process where event.action == "exec" and process.name : "lxc" and 
    process.args : ("import", "restore") and 
    process.args : ("*.tar.xz", "*.tar.gz", "*.tar") and
    process.args : ("*../*", "*..%2f*") ]
  [ file where event.action == "write" and 
    not file.path : ("/var/lib/lxd/*", "/var/snap/lxd/*") ]

Splunk SPL Query

index=main sourcetype=linux_secure OR sourcetype=auditd
| where process_name="lxc" AND (command_line LIKE "%import%" OR command_line LIKE "%restore%")
| search command_line IN ("*../*", "*,./*", "*.%2e%2e*", "*.%2f*")
| eval traversal_detected=if(match(command_line, "(\.\./|%2e%2e%2f|\.\.%2f)"), "yes", "no")
| where traversal_detected="yes"
| table _time, host, user, process_name, command_line, file_path
| sort -_time

Wazuh OSSEC Rule

<group name="lxd,">
  <rule id="461881" level="12">
    <decoded>Command executed</decoded>
    <field name="command">>lxc import</field>
    <regex>\.\./|%2e%2e%2f|\.\.%2f</regex>
    <description>Potential LXD backup path traversal exploit (CVE-2026-66898)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack_attempt,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. The vendor has not released a fix, and no affected version list has been published.

1) Immediate Mitigations (pre-patch):

• Restrict access to the LXD REST API. Bind the daemon to localhost or a trusted management network only. Do not expose port 8443 to untrusted networks.
• Apply strict RBAC policies. Limit which users/groups can invoke backup import/restore operations. Remove users from the lxd group unless absolutely necessary, as membership grants effective root access.
• Disable backup import/restore API endpoints via lxd ACL configuration if the feature is not operationally required.
• Monitor and audit all backup import activities. Enable auditd logging for LXD-related syscalls and review file writes outside expected directories.
• If backups must be imported, perform manual review of archive manifests before import. Scan metadata.yaml for path traversal patterns.

2) Patch/Upgrade Steps:

• Monitor vendor channels (Canonical security notices, LXD GitHub releases) for a patched version. Apply the security update immediately upon release.
• Until a patch is available, consider pinning LXD to a version and tracking new releases closely.
• Verify the integrity of backup archives using cryptographic signatures from trusted sources before import.

3) Long-Term Hardening:

• Implement network segmentation. Place LXD management interfaces behind a jump host or VPN.
• Harden the host OS with SELinux/AppArmor profiles that restrict the lxd daemon's write access outside expected paths.
• Use secure baseline images and regularly snapshot host configurations to enable rapid recovery.
• Subscribe to CVE alerts for LXD via NVD and vendor security feeds.
• Conduct regular penetration testing of management interfaces, specifically testing backup/restore functionality with malformed inputs.

References

1. NVD Entry for CVE-2026-66898: https://nvd.nist.gov/vuln/detail/CVE-2026-66898
2. LXD Official Documentation (backup/restore): https://linuxcontainers.org/lxd/docs/master/backup/
3. CANONICAL Security Notices: https://ubuntu.com/security/notices
4. CWE-22 Path Traversal Reference: https://cwe.mitre.org/data/definitions/22.html
5. LXD GitHub Repository (for patch monitoring): https://github.com/canonical/lxd

Threat Actor Activity: No known threat actor campaigns or in-the-wild exploitation evidence are documented for this CVE as of this report. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, and no public PoC or exploit code has been confirmed.