CVE-2026-87799

Summary

This vulnerability allows an authenticated client or a malicious migration source server to write attacker-controlled files to arbitrary paths on the target host as root, leading to full host compromise.

Exploitability

Exploitation requires an authenticated client or a malicious migration source server. The attacker must create instances or custom storage volumes in a project and use a crafted rsync or btrfs send stream.

Blast radius

If exploited, the attacker can gain full control over the target host, potentially leading to data loss, system compromise, and unauthorized access.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to LXD 4.0.14, 5.0.10, 5.21.8, or 6.10 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.