# CVE-2026-87799

Authenticated LXD migration flaw allows arbitrary root file writes and full host takeover.

- Page: https://www.vulneraibility.com/cve/CVE-2026-87799
- CVSS: 9.9
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.41% (percentile 35.5)
- CISA SSVC: exploitation none, automatable no, technical impact total (assessed 2026-09-28)
- Weakness: CWE-59
- Also known as: GHSA-fmc3-3cpq-6whr
- Published: 2026-09-28

## Affected versions

- Canonical LXD: affected >= 4.0.0 and < 4.0.14; >= 5.0.0 and < 5.0.10; >= 5.21.0 and < 5.21.8; >= 6.0 and < 6.10

A version outside these ranges is not a statement that it is unaffected.

## Impact

Authenticated instance/volume creators or malicious migration servers can use crafted rsync/btrfs streams to plant symlinks and write arbitrary files as root, enabling full host compromise.

## Action

Immediate action required

## Recommendation

Upgrade LXD to fixed versions immediately; restrict/disable untrusted migrations and project create permissions.

## References

- [advisory] https://github.com/canonical/lxd/security/advisories/GHSA-fmc3-3cpq-6whr

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.