CVE-2026-87798

Executive Summary

CVE-2026-87798 is an improper link resolution vulnerability (CWE-59) in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 through 6.9. An attacker with root access inside a guest virtual machine can operate a modified lxd-agent that returns inconsistent SFTP directory listings and Lstat results, causing the client to write attacker-controlled files or directory trees to arbitrary paths on the operator's host with the operator's privileges. Exploitation requires the operator to initiate a recursive file pull from the compromised guest, making it a host-integrity risk for any operator who pulls files from untrusted or tenant-controlled virtual machines.

Technical Analysis

The vulnerability resides in the client-side recursive file pull path of the LXD CLI. When an operator pulls a directory recursively from an instance, the client must enumerate the remote tree and reconstruct it locally. It relies on two classes of responses from the guest-side agent: SFTP directory listings (which describe the entries in each directory) and Lstat results (which describe the type and attributes of an individual path, including whether it is a symlink, a regular file, or a directory).

The core defect is improper link resolution: the client does not consistently reconcile the type information returned by the directory listing against the type information returned by Lstat, nor does it validate that a resolved path remains within the intended destination subtree. Because the agent is attacker-controlled inside the VM, it can return a directory listing that describes an entry one way while the corresponding Lstat result describes it another way — for example, presenting an entry as an ordinary file or directory while the link resolution path treats it as a symbolic link pointing outside the destination directory. The client then follows that link during recursive reconstruction and writes the attacker-supplied content to the resolved location.

Two properties make this serious. First, the trust boundary is inverted: the operator's client trusts type and path metadata produced by software running in a VM the attacker already controls at root. Second, the write executes locally with the operator's privileges, and the CVSS scope subscore is Changed (S:C), acknowledging that the vulnerable component (the CLI client) affects resources beyond its own security authority (the host filesystem). There is no confidentiality or availability subscore — C:N and A:N — because the impact is integrity of arbitrary host paths, not data disclosure or denial of service. AC:H reflects that the attacker must induce the operator to run a recursive pull against the malicious guest, and UI:R reflects the required operator interaction.

The NVD description does not identify the specific function, module, or code path responsible, and no public proof-of-concept or exploit code is available. The analysis above is therefore limited to the vulnerability class (improper link resolution during recursive file transfer) and the observed-and-reported mechanism (inconsistent SFTP directory listing versus Lstat responses from a modified lxd-agent). No additional implementation detail is asserted here.

Exploitation Scenarios

1. Reconnaissance and target identification. The attacker gains root inside a virtual machine managed by LXD. This is the precondition stated in the advisory and may be achieved through any means that yields root in the guest. Having root, the attacker can install or replace the guest-side agent with a modified lxd-agent under their control. The attacker's target is the operator's host, not the guest.

2. Triggering the flaw class. The attacker's modified agent waits for a recursive file pull initiated by the operator and then returns crafted responses that are internally inconsistent: an SFTP directory listing that describes an entry differently from the Lstat result for that same path. This mismatch is the trigger for the improper link resolution in the client. The attacker must persuade or induce the operator to perform the recursive pull — for example, by planting content the operator wants and requesting that it be retrieved.

3. Payload and execution at the vulnerability-class level. Because the client trusts the inconsistent metadata, link resolution resolves outside the intended destination and the client writes attacker-controlled files or entire directory trees to arbitrary paths on the host, using the operator's privileges. The write itself is the primitive: attacker-chosen content lands at an attacker-chosen path. No public PoC is available; the attack chain is inferred from the vulnerability class described by the CNA.

4. Post-exploitation impact. Integrity of the host is compromised. Depending on the paths selected, this can range from overwriting configuration or data files to planting content in operator-writable locations that are later consumed by host processes, enabling further compromise of the host under the operator's account. The advisory does not describe a confidentiality or availability impact; the enumerated impact is integrity (I:H) with no C or A subscore.

Impact Assessment

Affected systems are LXD client installations in versions 4.0.2 through 6.9 running on Linux, where operators pull files recursively from guest VMs they do not fully control. The blast radius is the host filesystem as reachable by the operator's account — potentially any path the operator can write, including files outside the intended pull destination. CVSS 3.1 rates this 5.8 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N: network attack vector, high attack complexity (requires operator-triggered recursive pull and a modified agent returning inconsistent responses), low privileges required (root inside the guest, as stated in the advisory), user interaction required, and changed scope. Integrity impact is High, with no confidentiality or availability impact. EPSS is not yet scored by FIRST.org, so no exploitation-likelihood estimate should be assumed, and CVE-2026-87798 is not listed in CISA KEV. For organizations running multi-tenant or developer-controlled LXD guests, the practical exposure is a host-integrity escape vector gated on operator behavior rather than a remotely reachable unauthenticated service flaw.

Detection Guidance

Sigma Rule

title: LXD CLI Recursive File Pull From Untrusted Guest Agent
id: 8f3a2c41-7d19-4b6e-9c52-1a4e77d90b13
status: experimental
description: Detects lxc client processes performing recursive file pulls, the operator-side action required to trigger CVE-2026-87798 improper link resolution.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87798
author: valtersit.com
date: 2026-01-01
logsource:
  category: process_creation
  product: linux
detection:
  selection_binary:
    Image|endswith:
      - '/lxc'
      - '/lxd'
  selection_pull:
    CommandLine|contains:
      - ' file pull '
      - ' file pull '
  selection_recursive:
    CommandLine|contains:
      - ' -r '
      - ' --recursive '
  condition: selection_binary and selection_pull and selection_recursive
fields:
  - Image
  - CommandLine
  - User
  - ParentImage
falsepositives:
  - Legitimate administrative file collection from trusted instances
level: medium
tags:
  - attack.t1080
  - cve.2026.87798

YARA Rule

rule CVE_2026_87798_LXD_Agent_Link_Resolution_Abuse
{
    meta:
        description = "Detects modified lxd-agent binaries associated with CVE-2026-87798 inconsistent SFTP directory listing and Lstat responses"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87798"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $agent = "lxd-agent" ascii wide nocase
        $sftp = "sftp" ascii wide nocase
        $lstat = "Lstat" ascii wide
        $listing = "directory listing" ascii wide nocase
        $pull = "recursive" ascii wide nocase

    condition:
        (uint32(0) == 0x464c457f or uint16(0) == 0x5a4d) and
        $agent and
        (2 of ($sftp, $lstat, $listing, $pull))
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-87798 LXD Agent Recursive Pull Anomalous SFTP Traversal Response"; flow:established,to_client; content:"SSH-2.0"; content:"sftp"; nocase; content:".."; distance:0; content:"/"; distance:0; pcre:"/(?:Lstat|SSH_FXP_LSTAT|SSH_FXP_READLINK)/i"; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-user; reference:cve,2026-87798; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87798; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:202687798; rev:1;)

Elastic Detection

process where host.os.type == "linux" and
  event.action == "exec" and
  process.name in ("lxc", "lxd") and
  process.command_line : "*file pull*" and
  process.command_line : ("*-r*" or "*--recursive*")

Splunk SPL Query

index=linux sourcetype=auditd OR sourcetype=sysmon_linux
(process_name="lxc" OR process_name="lxd" OR Image="*/lxc" OR Image="*/lxd")
(CommandLine="*file pull*" AND (CommandLine="* -r *" OR CommandLine="*--recursive*"))
| eval risk="CVE-2026-87798 recursive pull from guest; verify agent integrity"
| table _time host user CommandLine ParentCommandLine risk
| sort - _time

Wazuh OSSEC Rule

<group name="lxd,cve_2026_87798,">
  <rule id="202687798" level="8">
    <if_sid>80700</if_sid>
    <field name="audit.command">lxc|lxd</field>
    <match>file pull</match>
    <regex>\.\s*-r\s|--recursive</regex>
    <description>CVE-2026-87798: LXD client recursive file pull detected - potential host write via malicious guest agent</description>
    <mitre>
      <id>T1080</id>
    </mitre>
    <group>process_monitor,host_integrity,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The version ceilings in the NVD description (fixed in 4.0.14, 5.0.10, 5.21.8) are advisory-provided only and must be verified against the vendor before relying on them; do not assume availability of a verified build.

1. Immediate mitigations: Stop performing recursive file pulls from any guest VM that is not fully trusted or that an attacker may have held root in. Where the content must be retrieved, pull specific files individually rather than whole directory trees, and never pull into a destination directory containing sensitive or executable paths. Restrict which accounts can run lxc/lxd client operations on host workstations, and treat any guest with root-capable tenant access as an untrusted data source. Isolate the destination of pulls to a disposable, non-privileged directory outside operator-writable system paths.

2. Patch/upgrade steps: Canonical has published fixed versions per the advisory (4.0.14, 5.0.10, 5.21.8 for their respective tracks). Confirm those builds are actually available in your distribution or snap channel before planning the change, then upgrade the LXD CLI client on every host that performs pulls. For LTS tracks, target the highest available maintenance release. Because patch-source confidence here is zero, validate the fix against the vendor advisory and changelog rather than assuming the version numbers alone resolve the issue.

3. Long-term hardening: Enforce a policy that recursive pulls are performed only from trusted images and managed instances, and log every recursive pull. Treat the guest agent as untrusted input and avoid workflows where a tenant can influence the enumerated tree. Use read-only or restricted destination directories for any retrieval from semi-trusted instances. Monitor for anomalous client behavior such as writes landing outside the intended destination directory, and integrate the detection rules above into host monitoring. Track the NVD entry for vendor confirmation, CVSS updates, and any change in patch or EPSS status.

References

• NVD — CVE-2026-87798: https://nvd.nist.gov/vuln/detail/CVE-2026-87798
• MITRE CWE-59 — Improper Link Resolution Before File Access: https://cwe.mitre.org/data/definitions/59.html
• Canonical LXD project site and release notes: https://linuxcontainers.org/lxd/ (verify advisory and fixed builds 4.0.14, 5.0.10, 5.21.8)
• FIRST EPSS — not yet scored for this CVE: https://api.first.org/data/v1/epss?cve=CVE-2026-87798
• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-87798 not listed: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, Nuclei template, or exploit-in-the-wild activity has been observed for CVE-2026-87798 in the provided data. No threat actor campaigns are associated with this CVE at this time.