CVE-2026-87799

Executive Summary

CVE-2026-87799 is a critical improper link resolution vulnerability (CWE-59) in Canonical LXD versions 4.0 and later, with fixes available in 4.0.14, 5.0.10, 5.21.8, and 6.10. An authenticated client with permissions to create instances or custom storage volumes, or a malicious migration source server, can craft a malicious rsync or btrfs send stream that plants a symlink in a transferred volume and writes through it to arbitrary host paths as root, resulting in full host compromise. With a CVSS score of 9.9, this represents a severe container breakout and privilege escalation risk for organizations using LXD for multi-tenant or migration-enabled workloads.

Technical Analysis

The vulnerability resides in the migration receive path of Canonical LXD, specifically in how the system resolves symbolic links during the transfer of instance or custom storage volumes. LXD supports migration between hosts using protocols such as rsync and btrfs send streams. When a migration is received, LXD extracts the transferred volume contents onto the target host. The flaw is classified as CWE-59: Improper Link Resolution Before File Access ('Link Following').

The core issue is that during the receive path, LXD does not adequately validate or canonicalize symlinks that are present in the transferred volume. An attacker can craft an rsync or btrfs send stream that includes a symlink inside the volume—such as a link named "rootfs" or "root.img"—that points to an arbitrary path on the target host's filesystem. Because the migration receive process operates with root privileges, any subsequent file write through that symlink will occur outside the intended volume boundary and target the attacker-chosen path on the host.

This is a classic symlink-following vulnerability in a privileged file extraction routine. The attack does not require remote code execution or memory corruption; it abuses legitimate migration functionality and the trust LXD places in the integrity of the incoming stream. The vulnerability is network-accessible (AV:N), requires low privileges (PR:L), and no user interaction (UI:N), but has a changed scope (S:C) because a compromise within the container/project context escalates to the host root context, violating the security boundary between the LXD project and the host.

The attack surface includes:

• The LXD migration API endpoints that accept incoming instance or storage volume transfers.
• The rsync and btrfs send/receive data channels.
• Any project configuration that allows a less-trusted user to create instances or custom storage volumes.

Notably, the NVD description explicitly mentions two threat vectors: an authenticated client with instance/volume creation rights, and a malicious migration source server. The latter is significant because it allows an attacker who controls a source LXD server to compromise a target LXD host that initiates or accepts a migration from that source without the attacker needing any local account on the target.

Exploitation Scenarios

The exploitation of CVE-2026-87799 follows the generic attack chain for a privileged symlink-following vulnerability during archive/stream extraction. No public PoC or exploit code is available; the following is inferred strictly from the vulnerability class and the details provided in the NVD description.

1. Reconnaissance / Target Identification: The attacker identifies a target LXD host that exposes the LXD API and is configured to allow migrations or accepts clients with instance/custom storage volume creation privileges. The attacker may also operate a malicious migration source server that initiates a migration to the target, or trick the target administrator into migrating from the attacker-controlled source.

2. Triggering the Flaw Class: The attacker crafts a malicious migration payload—either an rsync stream or a btrfs send stream—representing an instance or custom storage volume. Within this stream, the attacker includes a symbolic link (e.g., a link named "rootfs" or "root.img" as stated in the description) that points to an arbitrary path on the target host, such as /etc or /root. The stream is sent to the LXD migration receive path on the target. Because LXD fails to properly resolve or sanitize this link before extracting/writing files, the symlink is accepted and materialized on the target filesystem.

3. Payload / Execution: Following the symlink planting, the attacker causes file data from the stream to be written through that symlink. Because the migration receive process runs as root, the write follows the symlink to the attacker-chosen absolute path on the host. This allows the attacker to write attacker-controlled files anywhere on the target host filesystem with root privileges. Examples of impact include overwriting authorized_keys, cron jobs, systemd unit files, or other privileged configuration to establish persistence or execute arbitrary code.

4. Post-Exploitation Impact: Successful exploitation results in arbitrary file write as root on the target host, which is effectively full host compromise. The attacker can escalate to root code execution, persist across reboots, and move laterally to other containers or services hosted on the same LXD daemon. Because the vulnerability crosses the container-to-host boundary (scope changed), it defeats the isolation that multi-tenant LXD deployments rely on.

Impact Assessment

This is a critical vulnerability with a CVSS base score of 9.9. The vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H indicates:

• Attack Vector: Network (AV:N) — exploitable remotely over the network via LXD's API or migration channels.
• Attack Complexity: Low (AC:L) — no special conditions or race windows are required once the attacker can send a crafted stream.
• Privileges Required: Low (PR:L) — the attacker needs a low-privileged authenticated account or control of a migration source server.
• User Interaction: None (UI:N) — no victim interaction is necessary.
• Scope: Changed (S:C) — a vulnerability in the container/project context impacts the host, breaking the security boundary.
• Confidentiality, Integrity, Availability: High (C:H/I:H/A:H) — arbitrary file write as root can lead to full loss of confidentiality, integrity, and availability.

Business impact includes complete host compromise, potential data exfiltration across all hosted instances and volumes, ransomware deployment, and lateral movement within data centers or cloud environments that use LXD for container/VM management. The blast radius is severe in multi-tenant environments where LXD projects are used to isolate customers or teams, because the flaw allows one tenant (or a malicious external migration partner) to take over the entire host and affect all other tenants.

Detection Guidance

Sigma Rule

title: Potential LXD Migration Symlink Following Exploitation (CVE-2026-87799)
id: 3f9c1b7e-8d2a-4c5e-9f6a-1b2c3d4e5f60
status: experimental
description: Detects suspicious activity related to LXD migration receive path that may indicate exploitation of CVE-2026-87799 through crafted rsync or btrfs streams planting symlinks.
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: linux
  service: auditd
detection:
  selection_lxd:
    exe|endswith:
      - '/lxd'
      - '/lxc'
    comm:
      - 'lxd'
  selection_symlink:
    type: 'SYMLINK'
    name|contains:
      - 'rootfs'
      - 'root.img'
  selection_write:
    syscall:
      - 'openat'
      - 'write'
    key: 'lxd_migration'
  condition: selection_lxd and selection_symlink and selection_write
falsepositives:
  - Legitimate LXD migrations that include symlinks within volumes.
level: high
tags:
  - attack.t1190
  - cve.2026.87799

YARA Rule

rule CVE_2026_87799_LXD_Migration_Symlink
{
    meta:
        description = "Detects crafted migration streams targeting LXD symlink following (CVE-2026-87799)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87799"
        severity = "critical"
    strings:
        $rsync_magic = { 72 73 79 6E 63 } // "rsync" placeholder marker
        $btrfs_magic = { 5F 42 48 52 66 53 5F 4D 61 67 69 63 } // _BHRfS_Magic
        $symlink_rootfs = "rootfs" ascii wide
        $symlink_rootimg = "root.img" ascii wide
        $migration_header = "migration" ascii nocase
    condition:
        ($btrfs_magic or $rsync_magic) and ($symlink_rootfs or $symlink_rootimg)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-87799 LXD Migration Symlink Following Attempt"; flow:established,to_server; content:"POST"; http_method; content:"/1.0/instances"; http_uri; content:"migration"; http_uri; content:"|72 6F 6F 74 66 73|"; within:200; content:"|72 6F 6F 74 2E 69 6D 67|"; within:200; classtype:attempted-admin; sid:202687799; rev:1; metadata:created_at 2026_01_01, cve CVE_2026_87799;)

Elastic Detection

process where event.type == "start" and process.name in ("lxd", "lxc") and process.args : "*migration*" and process.args : "*receive*"

Splunk SPL Query

index=linux sourcetype=auditd OR sourcetype=syslog
(process_name=lxd OR process_name=lxc OR comm=lxd)
("migration" OR "migrate" OR "rsync" OR "btrfs")
("symlink" OR "rootfs" OR "root.img")
| stats count by host, process_name, user, _time
| where count > 0

Wazuh OSSEC Rule

<group name="lxd,cve-2026-87799,">
  <rule id="100877" level="12">
    <decoded_as>json</decoded_as>
    <field name="process.name">lxd|lxc</field>
    <field name="process.args">migration</field>
    <field name="process.args">receive|rsync|btrfs</field>
    <description>CVE-2026-87799: Potential LXD migration symlink following activity detected.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>container_escape,privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

• Restrict LXD API access to trusted networks and authenticated users. Do not expose the LXD API to untrusted clients.
• Remove or tightly control permissions that allow users or projects to create instances or custom storage volumes.
• Avoid initiating or accepting migrations from untrusted source servers. Validate the integrity and origin of any migration stream before processing.
• If migration is not required, disable it entirely.
• Monitor for abnormal symlink creation within LXD volumes (e.g., rootfs, root.img) and for writes through those links to host paths.

2. Patch/Upgrade Steps:

• Although patch confidence is low, the NVD description states the issue is fixed in LXD 4.0.14, 5.0.10, 5.21.8, and 6.10.
• Administrators should upgrade to the corresponding fixed version:
  • LXD 4.0.x → 4.0.14 or later
  • LXD 5.0.x → 5.0.10 or later
  • LXD 5.21.x → 5.21.8 or later
  • LXD 6.x → 6.10 or later
• Verify the upgrade through the official Canonical LXD release channels and validate the installed version (e.g., lxc --version).
• Because no vendor advisory or patch source was tracked, confirm the fix availability directly with Canonical before relying solely on this information.

3. Long-Term Hardening:

• Implement strict project isolation and least-privilege access for LXD users.
• Use mandatory access control (AppArmor, SELinux) profiles that prevent LXD migration processes from following symlinks outside designated directories.
• Adopt filesystem-level protections (e.g., mount options) that block symlink traversal during extraction.
• Regularly audit migration logs and file integrity on LXD hosts.
• Keep LXD and all container management tooling fully patched and subscribe to Canonical security announcements.

References

1. NVD — CVE-2026-87799: https://nvd.nist.gov/vuln/detail/CVE-2026-87799
2. Canonical LXD Security Documentation: https://ubuntu.com/security/cves
3. CWE-59: Improper Link Resolution Before File Access: https://cwe.mitre.org/data/definitions/59.html
4. LXD GitHub Repository and Release Notes: https://github.com/canonical/lxd/releases
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-87799 is not currently listed in CISA KEV)