Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidents
LivePatchedPatch now

LXD host escapes via malicious images, backup compression, and project-restriction bypasses (GHSA-jpf8 / GHSA-9j25 / GHSA-vghh / GHSA-pjff / GHSA-fmc8 / GHSA-47w9 / GHSA-7mr3 / GHSA-qx75)

Canonical LXD (Incus fork also affected)

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

On Nov 6 2026 Canonical published a wave of critical LXD advisories (CVSS 9.9) for host escapes. Already tracked: GHSA-jpf8-86f3-wp38 / CVE-2026-48752 (templates/ symlink AFRW) and GHSA-9j25-mm2h-2f76 / CVE-2026-48750 (exec-output symlink AFW). Same-day additions: GHSA-vghh-5rfx-xhq8 / CVE-2026-48749 (rootfs/ symlink AFRW in a crafted image); GHSA-pjff-c2wc-f6jm / CVE-2026-48769 (arbitrary file write via trusted Incus-Image-Hash path traversal on source.type=url downloads); GHSA-fmc8-p6q7-75cc / CVE-2026-48755 (backup compression_algorithm argument injection leading to AFW/ACE). All were reported from the Incus fork. Fixes are in the github.com/canonical/lxd Go module; upgrade to fixed builds that include the advisory commits / firstPatched versions. Also folded GHSA-47w9-6r3f-938g / CVE-2026-48751: instance snapshots ignore `restricted.containers.lowlevel=block`, allowing abuse of raw.lxc / raw.qemu hooks for host ACE after moving a crafted snapshot into a restricted project; LXD >= 4.12 affected; patched in 6.9 / 5.21.5 / 5.0.7 (reported from Incus GHSA-48q5-w887-33wv; originally published Jun 26 2026, resurfaced in the Nov 6 critical GHSA wave). Further folded high-severity project-restriction bypasses GHSA-7mr3-28h5-m5vx (custom volume copy across projects) and GHSA-qx75-2p3r-pwm5 (instance copy across projects): authenticated caller knowing source project/volume or instance names can copy secrets they should not view; LXD >= 4.12; patched in 5.0.7 / 5.21.5 / 6.8 (note 6.8, not only 6.9); GHSA firstPatched Go module 0.0.0-20260630083100-c5184be310b1; reported from Incus GHSA-64f3-v33m-w89f and GHSA-c9f5-j9c3-mhrg; no CVE IDs assigned on the GitHub Advisory records as of this fold.

Why this severity: GitHub Advisory CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) for both; host AFRW / constrained AFW via image symlinks, possibly leading to command execution

Started
Nov 6, 2026
CVEs
CVE-2026-48752CVE-2026-48750CVE-2026-48749CVE-2026-48769CVE-2026-48755GHSA-jpf8-86f3-wp38GHSA-9j25-mm2h-2f76GHSA-vghh-5rfx-xhq8GHSA-pjff-c2wc-f6jmGHSA-fmc8-p6q7-75ccCVE-2026-48751GHSA-47w9-6r3f-938gGHSA-48q5-w887-33wvGHSA-7mr3-28h5-m5vxGHSA-qx75-2p3r-pwm5GHSA-64f3-v33m-w89fGHSA-c9f5-j9c3-mhrg

Follow this incident

Discuss on X ↗

Affected

  • github.com/canonical/lxd Go module before 0.0.0-20260203144152-d1c8ba15d160 (templates/ AFRW, GHSA-jpf8-86f3-wp38)
  • github.com/canonical/lxd Go module before 0.0.0-20260626085134-124f90100640 (exec-output AFW, GHSA-9j25-mm2h-2f76)
  • github.com/canonical/lxd Go module before 0.0.0-20260630083100-c5184be310b1 (rootfs/ symlink AFRW GHSA-vghh-5rfx-xhq8; image-hash AFW GHSA-pjff-c2wc-f6jm; backup compression injection GHSA-fmc8-p6q7-75cc; restricted project bypass GHSA-47w9-6r3f-938g; volume-copy bypass GHSA-7mr3-28h5-m5vx; instance-copy bypass GHSA-qx75-2p3r-pwm5)
  • Incus builds affected by the related Incus advisories cited in the LXD GHSAs
  • LXD >= 4.12 (restricted project bypass via instance snapshots ignoring restricted.containers.lowlevel=block, GHSA-47w9-6r3f-938g / CVE-2026-48751)
  • LXD >= 4.12 (project restriction bypass for custom volume copy across projects, GHSA-7mr3-28h5-m5vx)
  • LXD >= 4.12 (project restriction bypass for instance copy across projects, GHSA-qx75-2p3r-pwm5)

Fixed in

  • github.com/canonical/lxd 0.0.0-20260203144152-d1c8ba15d160 or later (templates/ fix per GHSA-jpf8-86f3-wp38)
  • github.com/canonical/lxd 0.0.0-20260626085134-124f90100640 or later (exec-output fix per GHSA-9j25-mm2h-2f76)
  • github.com/canonical/lxd 0.0.0-20260630083100-c5184be310b1 or later (GHSA-vghh-5rfx-xhq8 / GHSA-pjff-c2wc-f6jm / GHSA-fmc8-p6q7-75cc / GHSA-47w9-6r3f-938g / GHSA-7mr3-28h5-m5vx / GHSA-qx75-2p3r-pwm5)
  • lxd-5.21.5 referenced by GHSA-9j25-mm2h-2f76; upgrade to fixed LXD releases that include the advisory commits
  • LXD 6.9, 5.21.5, 5.0.7 (GHSA-47w9-6r3f-938g / CVE-2026-48751 restricted project bypass)
  • LXD 6.8, 5.21.5, 5.0.7 (GHSA-7mr3-28h5-m5vx / GHSA-qx75-2p3r-pwm5 project restriction bypasses; note 6.8 for these High advisories)

Timeline8

  1. Canonical publishes GHSA-9j25-mm2h-2f76 (CVE-2026-48750): arbitrary file write on host via exec-output symlink in a crafted image; CVSS 9.9; firstPatched Go module 0.0.0-20260626085134-124f90100640; references lxd-5.21.5 and Incus GHSA-73hr-m85f-64v9.

  2. Canonical publishes GHSA-jpf8-86f3-wp38 (CVE-2026-48752): arbitrary file read+write on host via templates/ symlink in a malicious image; CVSS 9.9; firstPatched Go module 0.0.0-20260203144152-d1c8ba15d160; reported from Incus GHSA-vxp5-584q-c479.

  3. Canonical publishes GHSA-vghh-5rfx-xhq8 (CVE-2026-48749): host AFRW via rootfs/ symlink in a malicious image; CVSS 9.9; firstPatched Go module 0.0.0-20260630083100-c5184be310b1.

  4. Canonical publishes GHSA-pjff-c2wc-f6jm (CVE-2026-48769): arbitrary file write via trusted Incus-Image-Hash path traversal on source.type=url image downloads; CVSS 9.9; firstPatched 0.0.0-20260630083100-c5184be310b1.

  5. Canonical publishes GHSA-fmc8-p6q7-75cc (CVE-2026-48755): backup compression_algorithm argument injection leading to host AFW/ACE; CVSS 9.9; firstPatched 0.0.0-20260630083100-c5184be310b1.

  6. Folded GHSA-47w9-6r3f-938g (CVE-2026-48751): restricted project bypass — instance snapshots ignore restricted.containers.lowlevel=block; abuse raw.lxc / raw.qemu for host ACE; LXD >= 4.12 affected; patched in 6.9 / 5.21.5 / 5.0.7; reported from Incus GHSA-48q5-w887-33wv. Originally published Jun 26 2026; resurfaced in the Nov 6 LXD critical GHSA wave.

  7. Folded GHSA-7mr3-28h5-m5vx (High, CVSS 7.7): project restriction bypass for custom volume copy across projects; LXD >= 4.12; patched 5.0.7 / 5.21.5 / 6.8; firstPatched Go module 0.0.0-20260630083100-c5184be310b1; reported from Incus GHSA-64f3-v33m-w89f; no CVE ID on GHSA record.

  8. Folded GHSA-qx75-2p3r-pwm5 (High, CVSS 7.7): project restriction bypass for instance copy across projects; LXD >= 4.12; patched 5.0.7 / 5.21.5 / 6.8; firstPatched Go module 0.0.0-20260630083100-c5184be310b1; reported from Incus GHSA-c9f5-j9c3-mhrg; no CVE ID on GHSA record.

Advisories31

Notes & caveats

Do not invent additional LXD release tags beyond what GHSA/NVD/release pages state. Prefer upgrading to fixed LXD releases that include the advisory commits; GHSA firstPatched Go module versions are the authoritative patched markers when a product release tag is unclear.

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo