Database/Container, Kubernetes & orchestration

LXD: crafted image templates escape the instance template directory and read or create host files

CVE-2026-16033Container, Kubernetes & orchestrationcurated

Impact

A user who can get LXD to unpack an image they control can make the daemon read arbitrary files on the host or create files outside the instance template directory. LXD runs as root on the host, so this crosses the instance boundary in the direction operators care about: from a tenant-supplied artifact into host filesystem state. On a shared node that hosts several tenants' system containers or VMs, that means host secrets (daemon credentials, keys, other tenants' config) are reachable, and unconstrained file creation gives a foothold for further host-level tampering. NVD scores it 8.5 with scope change, consistent with the escape from instance context to host context.

Who can reach it

An authenticated user with permission to supply an image to LXD - image import or instance creation from a crafted image archive. Network reachable against the LXD API (AV:N, PR:L); no host access needed.

What to do

Upgrade LXD to a version carrying the fix from the Canonical advisory GHSA-9hcm-hxh5-7xxh; the advisory is the authority on which channels are patched - the NVD record names no fixed version. Applying the update restarts the lxd daemon, which briefly interrupts the API and management path; plan it as a daemon restart per host rather than a node drain. Until patched, restrict who may import images or create instances from untrusted image sources.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-16033 https://github.com/canonical/lxd/security/advisories/GHSA-9hcm-hxh5-7xxh

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.