{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "LXD host escapes via malicious images, backup compression, and project-restriction bypasses (GHSA-jpf8 / GHSA-9j25 / GHSA-vghh / GHSA-pjff / GHSA-fmc8 / GHSA-47w9 / GHSA-7mr3 / GHSA-qx75) · updates",
  "home_page_url": "https://pwn.watch/i/lxd-malicious-image-host-escape-ghsa-2026-11",
  "feed_url": "https://pwn.watch/i/lxd-malicious-image-host-escape-ghsa-2026-11/feed.json",
  "description": "On Nov 6 2026 Canonical published a wave of critical LXD advisories (CVSS 9.9) for host escapes. Already tracked: GHSA-jpf8-86f3-wp38 / CVE-2026-48752 (templates/ symlink AFRW) and GHSA-9j25-mm2h-2f76 / CVE-2026-48750 (exec-output symlink AFW). Same-day additions: GHSA-vghh-5rfx-xhq8 / CVE-2026-48749 (rootfs/ symlink AFRW in a crafted image); GHSA-pjff-c2wc-f6jm / CVE-2026-48769 (arbitrary file write via trusted Incus-Image-Hash path traversal on source.type=url downloads); GHSA-fmc8-p6q7-75cc / CVE-2026-48755 (backup compression_algorithm argument injection leading to AFW/ACE). All were reported from the Incus fork. Fixes are in the github.com/canonical/lxd Go module; upgrade to fixed builds that include the advisory commits / firstPatched versions. Also folded GHSA-47w9-6r3f-938g / CVE-2026-48751: instance snapshots ignore `restricted.containers.lowlevel=block`, allowing abuse of raw.lxc / raw.qemu hooks for host ACE after moving a crafted snapshot into a restricted project; LXD >= 4.12 affected; patched in 6.9 / 5.21.5 / 5.0.7 (reported from Incus GHSA-48q5-w887-33wv; originally published Jun 26 2026, resurfaced in the Nov 6 critical GHSA wave). Further folded high-severity project-restriction bypasses GHSA-7mr3-28h5-m5vx (custom volume copy across projects) and GHSA-qx75-2p3r-pwm5 (instance copy across projects): authenticated caller knowing source project/volume or instance names can copy secrets they should not view; LXD >= 4.12; patched in 5.0.7 / 5.21.5 / 6.8 (note 6.8, not only 6.9); GHSA firstPatched Go module 0.0.0-20260630083100-c5184be310b1; reported from Incus GHSA-64f3-v33m-w89f and GHSA-c9f5-j9c3-mhrg; no CVE IDs assigned on the GitHub Advisory records as of this fold.",
  "language": "en",
  "_pwn": {
    "slug": "lxd-malicious-image-host-escape-ghsa-2026-11",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/lxd-malicious-image-host-escape-ghsa-2026-11/feed.xml",
    "llms": "https://pwn.watch/i/lxd-malicious-image-host-escape-ghsa-2026-11/llms.txt",
    "json": "https://pwn.watch/i/lxd-malicious-image-host-escape-ghsa-2026-11.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/lxd-malicious-image-host-escape-ghsa-2026-11#2026-11-06-ff773af3",
      "url": "https://pwn.watch/i/lxd-malicious-image-host-escape-ghsa-2026-11#2026-11-06-ff773af3",
      "title": "LXD host escapes via malicious images, backup compression, and project-restriction bypasses (GHSA-jpf8 / GHSA-9j25 / GHSA-vghh / GHSA-pjff / GHSA-fmc8 / GHSA-47w9 / GHSA-7mr3 / GHSA-qx75): Canonical publishes GHSA-9j25-mm2h-2f76 (CVE-2026-48750): arbitrary file write on host via exec-output symlink in a crafted image; CVSS 9.9; firstPatched Go module 0.0.0-20260626085134-124f90100640; references lxd-5.21.5 and Incus GHSA-73hr-m85f-64v9.",
      "content_text": "LXD host escapes via malicious images, backup compression, and project-restriction bypasses (GHSA-jpf8 / GHSA-9j25 / GHSA-vghh / GHSA-pjff / GHSA-fmc8 / GHSA-47w9 / GHSA-7mr3 / GHSA-qx75): Canonical publishes GHSA-9j25-mm2h-2f76 (CVE-2026-48750): arbitrary file write on host via exec-output symlink in a crafted image; CVSS 9.9; firstPatched Go module 0.0.0-20260626085134-124f90100640; references lxd-5.21.5 and Incus GHSA-73hr-m85f-64v9.\n\nSource: https://github.com/advisories/GHSA-9j25-mm2h-2f76",
      "date_published": "2026-11-06T00:00:00.000Z",
      "external_url": "https://github.com/advisories/GHSA-9j25-mm2h-2f76",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/lxd-malicious-image-host-escape-ghsa-2026-11#2026-11-06-18aa7ad7",
      "url": "https://pwn.watch/i/lxd-malicious-image-host-escape-ghsa-2026-11#2026-11-06-18aa7ad7",
      "title": "LXD host escapes via malicious images, backup compression, and project-restriction bypasses (GHSA-jpf8 / GHSA-9j25 / GHSA-vghh / GHSA-pjff / GHSA-fmc8 / GHSA-47w9 / GHSA-7mr3 / GHSA-qx75): Canonical publishes GHSA-jpf8-86f3-wp38 (CVE-2026-48752): arbitrary file read+write on host via templates/ symlink in a malicious image; CVSS 9.9; firstPatched Go module 0.0.0-20260203144152-d1c8ba15d160; reported from Incus GHSA-vxp5-584q-c479.",
      "content_text": "LXD host escapes via malicious images, backup compression, and project-restriction bypasses (GHSA-jpf8 / GHSA-9j25 / GHSA-vghh / GHSA-pjff / GHSA-fmc8 / GHSA-47w9 / GHSA-7mr3 / GHSA-qx75): Canonical publishes GHSA-jpf8-86f3-wp38 (CVE-2026-48752): arbitrary file read+write on host via templates/ symlink in a malicious image; CVSS 9.9; firstPatched Go module 0.0.0-20260203144152-d1c8ba15d160; reported from Incus GHSA-vxp5-584q-c479.\n\nSource: https://github.com/advisories/GHSA-jpf8-86f3-wp38",
      "date_published": "2026-11-06T00:00:00.000Z",
      "external_url": "https://github.com/advisories/GHSA-jpf8-86f3-wp38",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/lxd-malicious-image-host-escape-ghsa-2026-11#2026-11-06-b639bb56",
      "url": "https://pwn.watch/i/lxd-malicious-image-host-escape-ghsa-2026-11#2026-11-06-b639bb56",
      "title": "LXD host escapes via malicious images, backup compression, and project-restriction bypasses (GHSA-jpf8 / GHSA-9j25 / GHSA-vghh / GHSA-pjff / GHSA-fmc8 / GHSA-47w9 / GHSA-7mr3 / GHSA-qx75): Canonical publishes GHSA-vghh-5rfx-xhq8 (CVE-2026-48749): host AFRW via rootfs/ symlink in a malicious image; CVSS 9.9; firstPatched Go module 0.0.0-20260630083100-c5184be310b1.",
      "content_text": "LXD host escapes via malicious images, backup compression, and project-restriction bypasses (GHSA-jpf8 / GHSA-9j25 / GHSA-vghh / GHSA-pjff / GHSA-fmc8 / GHSA-47w9 / GHSA-7mr3 / GHSA-qx75): Canonical publishes GHSA-vghh-5rfx-xhq8 (CVE-2026-48749): host AFRW via rootfs/ symlink in a malicious image; CVSS 9.9; firstPatched Go module 0.0.0-20260630083100-c5184be310b1.\n\nSource: https://github.com/advisories/GHSA-vghh-5rfx-xhq8",
      "date_published": "2026-11-06T00:00:00.000Z",
      "external_url": "https://github.com/advisories/GHSA-vghh-5rfx-xhq8",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/lxd-malicious-image-host-escape-ghsa-2026-11#2026-11-06-2bd4c81f",
      "url": "https://pwn.watch/i/lxd-malicious-image-host-escape-ghsa-2026-11#2026-11-06-2bd4c81f",
      "title": "LXD host escapes via malicious images, backup compression, and project-restriction bypasses (GHSA-jpf8 / GHSA-9j25 / GHSA-vghh / GHSA-pjff / GHSA-fmc8 / GHSA-47w9 / GHSA-7mr3 / GHSA-qx75): Canonical publishes GHSA-pjff-c2wc-f6jm (CVE-2026-48769): arbitrary file write via trusted Incus-Image-Hash path traversal on source.type=url image downloads; CVSS 9.9; firstPatched 0.0.0-20260630083100-c5184be310b1.",
      "content_text": "LXD host escapes via malicious images, backup compression, and project-restriction bypasses (GHSA-jpf8 / GHSA-9j25 / GHSA-vghh / GHSA-pjff / GHSA-fmc8 / GHSA-47w9 / GHSA-7mr3 / GHSA-qx75): Canonical publishes GHSA-pjff-c2wc-f6jm (CVE-2026-48769): arbitrary file write via trusted Incus-Image-Hash path traversal on source.type=url image downloads; CVSS 9.9; firstPatched 0.0.0-20260630083100-c5184be310b1.\n\nSource: https://github.com/advisories/GHSA-pjff-c2wc-f6jm",
      "date_published": "2026-11-06T00:00:00.000Z",
      "external_url": "https://github.com/advisories/GHSA-pjff-c2wc-f6jm",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/lxd-malicious-image-host-escape-ghsa-2026-11#2026-11-06-384c73e3",
      "url": "https://pwn.watch/i/lxd-malicious-image-host-escape-ghsa-2026-11#2026-11-06-384c73e3",
      "title": "LXD host escapes via malicious images, backup compression, and project-restriction bypasses (GHSA-jpf8 / GHSA-9j25 / GHSA-vghh / GHSA-pjff / GHSA-fmc8 / GHSA-47w9 / GHSA-7mr3 / GHSA-qx75): Canonical publishes GHSA-fmc8-p6q7-75cc (CVE-2026-48755): backup compression_algorithm argument injection leading to host AFW/ACE; CVSS 9.9; firstPatched 0.0.0-20260630083100-c5184be310b1.",
      "content_text": "LXD host escapes via malicious images, backup compression, and project-restriction bypasses (GHSA-jpf8 / GHSA-9j25 / GHSA-vghh / GHSA-pjff / GHSA-fmc8 / GHSA-47w9 / GHSA-7mr3 / GHSA-qx75): Canonical publishes GHSA-fmc8-p6q7-75cc (CVE-2026-48755): backup compression_algorithm argument injection leading to host AFW/ACE; CVSS 9.9; firstPatched 0.0.0-20260630083100-c5184be310b1.\n\nSource: https://github.com/advisories/GHSA-fmc8-p6q7-75cc",
      "date_published": "2026-11-06T00:00:00.000Z",
      "external_url": "https://github.com/advisories/GHSA-fmc8-p6q7-75cc",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/lxd-malicious-image-host-escape-ghsa-2026-11#2026-11-06-8ad78b0f",
      "url": "https://pwn.watch/i/lxd-malicious-image-host-escape-ghsa-2026-11#2026-11-06-8ad78b0f",
      "title": "LXD host escapes via malicious images, backup compression, and project-restriction bypasses (GHSA-jpf8 / GHSA-9j25 / GHSA-vghh / GHSA-pjff / GHSA-fmc8 / GHSA-47w9 / GHSA-7mr3 / GHSA-qx75): Folded GHSA-47w9-6r3f-938g (CVE-2026-48751): restricted project bypass — instance snapshots ignore restricted.containers.lowlevel=block; abuse raw.lxc / raw.qemu for host ACE; LXD >= 4.12 affected; patched in 6.9 / 5.21.5 / 5.0.7; reported from Incus GHSA-48q5-w887-33wv. Originally published Jun 26 2026; resurfaced in the Nov 6 LXD critical GHSA wave.",
      "content_text": "LXD host escapes via malicious images, backup compression, and project-restriction bypasses (GHSA-jpf8 / GHSA-9j25 / GHSA-vghh / GHSA-pjff / GHSA-fmc8 / GHSA-47w9 / GHSA-7mr3 / GHSA-qx75): Folded GHSA-47w9-6r3f-938g (CVE-2026-48751): restricted project bypass — instance snapshots ignore restricted.containers.lowlevel=block; abuse raw.lxc / raw.qemu for host ACE; LXD >= 4.12 affected; patched in 6.9 / 5.21.5 / 5.0.7; reported from Incus GHSA-48q5-w887-33wv. Originally published Jun 26 2026; resurfaced in the Nov 6 LXD critical GHSA wave.\n\nSource: https://github.com/canonical/lxd/security/advisories/GHSA-47w9-6r3f-938g",
      "date_published": "2026-11-06T00:00:00.000Z",
      "external_url": "https://github.com/canonical/lxd/security/advisories/GHSA-47w9-6r3f-938g",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/lxd-malicious-image-host-escape-ghsa-2026-11#2026-11-06-60e0b850",
      "url": "https://pwn.watch/i/lxd-malicious-image-host-escape-ghsa-2026-11#2026-11-06-60e0b850",
      "title": "LXD host escapes via malicious images, backup compression, and project-restriction bypasses (GHSA-jpf8 / GHSA-9j25 / GHSA-vghh / GHSA-pjff / GHSA-fmc8 / GHSA-47w9 / GHSA-7mr3 / GHSA-qx75): Folded GHSA-7mr3-28h5-m5vx (High, CVSS 7.7): project restriction bypass for custom volume copy across projects; LXD >= 4.12; patched 5.0.7 / 5.21.5 / 6.8; firstPatched Go module 0.0.0-20260630083100-c5184be310b1; reported from Incus GHSA-64f3-v33m-w89f; no CVE ID on GHSA record.",
      "content_text": "LXD host escapes via malicious images, backup compression, and project-restriction bypasses (GHSA-jpf8 / GHSA-9j25 / GHSA-vghh / GHSA-pjff / GHSA-fmc8 / GHSA-47w9 / GHSA-7mr3 / GHSA-qx75): Folded GHSA-7mr3-28h5-m5vx (High, CVSS 7.7): project restriction bypass for custom volume copy across projects; LXD >= 4.12; patched 5.0.7 / 5.21.5 / 6.8; firstPatched Go module 0.0.0-20260630083100-c5184be310b1; reported from Incus GHSA-64f3-v33m-w89f; no CVE ID on GHSA record.\n\nSource: https://github.com/canonical/lxd/security/advisories/GHSA-7mr3-28h5-m5vx",
      "date_published": "2026-11-06T00:00:00.000Z",
      "external_url": "https://github.com/canonical/lxd/security/advisories/GHSA-7mr3-28h5-m5vx",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/lxd-malicious-image-host-escape-ghsa-2026-11#2026-11-06-c618cc93",
      "url": "https://pwn.watch/i/lxd-malicious-image-host-escape-ghsa-2026-11#2026-11-06-c618cc93",
      "title": "LXD host escapes via malicious images, backup compression, and project-restriction bypasses (GHSA-jpf8 / GHSA-9j25 / GHSA-vghh / GHSA-pjff / GHSA-fmc8 / GHSA-47w9 / GHSA-7mr3 / GHSA-qx75): Folded GHSA-qx75-2p3r-pwm5 (High, CVSS 7.7): project restriction bypass for instance copy across projects; LXD >= 4.12; patched 5.0.7 / 5.21.5 / 6.8; firstPatched Go module 0.0.0-20260630083100-c5184be310b1; reported from Incus GHSA-c9f5-j9c3-mhrg; no CVE ID on GHSA record.",
      "content_text": "LXD host escapes via malicious images, backup compression, and project-restriction bypasses (GHSA-jpf8 / GHSA-9j25 / GHSA-vghh / GHSA-pjff / GHSA-fmc8 / GHSA-47w9 / GHSA-7mr3 / GHSA-qx75): Folded GHSA-qx75-2p3r-pwm5 (High, CVSS 7.7): project restriction bypass for instance copy across projects; LXD >= 4.12; patched 5.0.7 / 5.21.5 / 6.8; firstPatched Go module 0.0.0-20260630083100-c5184be310b1; reported from Incus GHSA-c9f5-j9c3-mhrg; no CVE ID on GHSA record.\n\nSource: https://github.com/canonical/lxd/security/advisories/GHSA-qx75-2p3r-pwm5",
      "date_published": "2026-11-06T00:00:00.000Z",
      "external_url": "https://github.com/canonical/lxd/security/advisories/GHSA-qx75-2p3r-pwm5",
      "tags": [
        "critical"
      ]
    }
  ]
}