CVE-2026-49238: Canonical Multipass Path Traversal VM Escape Vulnerability

Technical summary

CVE-2026-49238 is a path containment bypass in Multipass's sshfs_server component (src/sshfs_mount/sftp_server.cpp). The validate_path function performs simple string prefix matching without normalizing path separators or resolving directory traversal sequences (.. notation). A guest-side attacker with root privileges can inject raw SFTP protocol frames (SSH_FXP_OPEN requests) directly into the sshfs_server process via procfs pipes, circumventing FUSE layer enforcement. By supplying paths that contain directory traversal sequences matching the allowed mount prefix, the attacker forces the host-side root process to resolve and open files outside the designated mount point, achieving arbitrary file read on the host filesystem.

Business impact

This vulnerability enables virtual machine escape with read access to host data. Organizations relying on Multipass for isolated guest environments face confidentiality loss if users with guest root access are compromised or malicious. Sensitive configuration files, credentials, application data, and intellectual property on the host become accessible to attackers inside the VM. The impact is heightened because the sshfs_server runs with host root privileges, meaning no file on the host is protected by standard permission checks once the path validation is bypassed.

Affected systems

Canonical Multipass versions prior to 1.16.3 are affected. This impacts users across Linux, macOS, and Windows platforms where Multipass is deployed for local virtual machine management, development environments, and containerization workflows. Any organization using Multipass for guest VM isolation should assess their deployment scope.

Exploitability

Exploitation requires local access with root privileges inside the guest VM, making this a post-compromise attack rather than a remote or unauthenticated entry point. However, once an attacker achieves guest root (through other vulnerabilities, misconfigurations, or lateral movement), the path bypass is straightforward to execute via procfs pipe injection without requiring special tools or intricate timing. The attack does not appear in CISA's Known Exploited Vulnerabilities catalog at this time.

Remediation

Update Canonical Multipass to version 1.16.3 or later. Verify the update via official Canonical repositories or the Multipass release notes. Organizations should prioritize patching in environments where guest VMs may be exposed to untrusted users or where guest compromise is a realistic threat model. Until patching is complete, restrict guest root access and implement host-level monitoring of SFTP server activity.

Patch guidance

Upgrade to Multipass 1.16.3 or newer as soon as operationally feasible. Check Canonical's official repositories and release channels for the patched version. Test the update in a non-production environment to confirm compatibility with your VM configurations and workflows before rolling out broadly. Verify that the patched sshfs_server properly normalizes paths and enforces mount boundaries after upgrade.

Detection guidance

Monitor for anomalous SFTP protocol activity within sshfs_server processes, particularly SSH_FXP_OPEN requests containing path traversal sequences (.. or absolute paths). Use file integrity monitoring on the host to detect unauthorized access to files outside expected VM mount points. Audit host-level procfs access patterns; legitimate sshfs_server operation should not involve direct pipe injection from guest processes. Review host system logs for unexpected file access attempts by the root-privileged sshfs_server process originating from malformed requests.

Why prioritize this

This is a HIGH severity virtual machine escape that allows arbitrary file read on the host by a guest-side attacker with root privileges. The combination of high confidentiality impact, direct path to exploitation once guest root is obtained, and the fact that sshfs_server executes as host root makes this a significant risk for environments where guest isolation is a security boundary. Prioritize patching in production deployments, particularly where guest VMs may be shared or exposed to less-trusted users.

Risk score, explained

CVSS 3.1 score of 8.4 (HIGH) reflects a local attack vector (AV:L), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), and scope change (S:C) enabling VM escape. High confidentiality impact (C:H) and high integrity impact (I:H) account for arbitrary file read and potential write implications of path normalization flaws. The absence of availability impact (A:N) reflects that this is a data access vulnerability rather than a denial-of-service issue.

Frequently asked questions