CVE-2026-49238: Multipass Host Filesystem Escape
High CVSS (8.4) vulnerability; prioritize internet-facing assets.
TL;DR - CVE-2026-49238 is a high-severity path-validation flaw in Canonical Multipass versions before 1.16.3. - A root-capable attacker inside a guest may read arbitrary host files through the privileged
sshfs_server. - No CISA KEV listing or confirmed active exploitation is known from the supplied sources. - Upgrade to Multipass 1.16.3 or later and review any exposed hosts.
Summary
CVE-2026-49238 is a Multipass vulnerability affecting Canonical Multipass versions before 1.16.3. Multipass is a virtualization tool for launching and managing Ubuntu and other Linux instances. The flaw is in the host-side SFTP server used to support filesystem mounts. That service runs with root privileges on the host, making a successful guest-side escape materially more serious than an ordinary guest-local information disclosure.
The vulnerability was published on 2026-05-28 and last modified on 2026-10-14. The supplied NVD data assigns a CVSS base score of 8.4 and rates the issue High. NVD did not supply a CVSS vector string in the available response, so defenders should verify the vector against the complete NVD record or Canonical’s advisory before using individual vector components for formal risk calculations.
| Field | Value |
|---|---|
| CVE ID | CVE-2026-49238 |
| Product | Canonical Multipass |
| Affected versions | Versions before 1.16.3 |
| Fixed version | 1.16.3 |
| CVSS base score | 8.4 High |
| Attack vector | Local guest-to-host attack path; authoritative CVSS vector requires verification |
| Authentication required | Not stated in the supplied CVSS data; practical exploitation requires root privileges inside a guest |
| Patch available | Yes |
| CISA KEV | No, not listed in the supplied lookup |
The immediate operational question is whether untrusted users or untrusted workloads can create, control, or compromise Multipass instances on a host. Systems meeting that condition should be treated as priority remediation targets. A guest running hostile code should not be considered a sufficient security boundary while a vulnerable Multipass installation remains in service.
Analyst’s Take: Prioritize this patch according to exposure, not only confirmed exploitation. Shared hosts and CI systems that run untrusted code combine the required guest compromise path with access to sensitive host data. The missing CVSS vector limits more granular risk scoring.
For context on vulnerability terminology, see our software vulnerability glossary.
Root Cause
The root cause is inadequate canonical path validation in the host-side sshfs_server component. Specifically, the validate_path function in src/sshfs_mount/sftp_server.cpp relies on a plain string-prefix comparison. A prefix check alone does not prove that a requested path remains within an authorized directory. For example, a permitted prefix can also match a sibling path unless the comparison enforces a path-component boundary.
The validation also does not adequately normalize traversal elements such as .. before authorization. Consequently, a path can appear to begin with the permitted mount prefix while resolving outside the intended mount boundary. The vulnerable process runs as root on the host, so the security impact extends beyond the guest’s normal mounted filesystem.
The attack path additionally depends on access to the sshfs_server process through procfs. A root attacker inside the guest can inject raw SFTP protocol frames, including an SSH_FXP_OPEN request, into the process’s standard-input and standard-output pipes. By combining that protocol interaction with crafted traversal paths, the attacker can cause the privileged service to read files outside the authorized directory.
This is a boundary-validation failure rather than a conventional SSH authentication weakness. The relevant questions are whether a compromised or malicious guest can reach the host-side process and whether users who can launch Multipass instances should be considered trusted. A network-facing SFTP port is not the deciding control.
Who’s Exposed
The affected product is Canonical Multipass. The affected version range identified in the supplied NVD data is:
- Affected: Multipass versions before 1.16.3
- Fixed: Multipass 1.16.3
- Recommended target: 1.16.3 or any later supported release
The available information does not provide a more granular breakdown by operating system, package manager, architecture, or distribution-specific backport. A package may report a distribution revision that differs from the upstream Multipass version. Organizations must therefore verify both the installed Multipass version and whether their package maintainer backported the security fix.
Exposure is highest on:
- Shared development hosts
- CI runners
- Lab systems
- Classroom machines
- Build infrastructure
- Hosts importing third-party images
- Systems executing pull requests in Multipass guests
- Environments running workloads that may be compromised after deployment
A Multipass host is not automatically exploitable merely because it runs a guest. The described attack requires a guest-side attacker with root privileges and a path to interact with the host-side sshfs_server through procfs. However, defenders should assume that an attacker who has obtained root in an affected guest can attempt the escape.
The absence of an untrusted-user model does not eliminate risk; it changes the likelihood and priority.
Severity Breakdown
The supplied NVD information assigns CVE-2026-49238 a CVSS base score of 8.4, categorized as High. The score reflects the potentially severe impact of crossing the guest-host boundary and reading arbitrary host files. Host file disclosure can expose credentials, private keys, configuration data, source code, tokens, and other material that enables follow-on compromise.
The authoritative CVSS vector was not included in the supplied NVD response. Therefore, the following operational interpretation should not be treated as a reconstructed official vector:
| Dimension | Available assessment |
|---|---|
| Attack context | Local interaction through a Multipass guest and host-side process |
| Privileges | Root privileges inside the guest are required by the described attack |
| User interaction | No separate host-user interaction is described |
| Scope | Potentially crosses from guest security context to host |
| Confidentiality | High potential impact because arbitrary host files may be read |
| Integrity | Not established by the supplied description |
| Availability | Not established by the supplied description |
The distinction between “local” and “remote” matters for prioritization. This is not described as a remotely exploitable host service accessible over the network. Nevertheless, containerized or virtualized workloads often process untrusted inputs, and an attacker may obtain guest root through a separate vulnerability before attempting this escape. Security teams should model CVE-2026-49238 as an escalation from guest compromise to host information disclosure.
Do not infer unsupported integrity or availability impacts from the score alone. The supplied description specifically establishes arbitrary host-file reads and virtual-machine escape. It does not establish host code execution, host-file modification, or denial of service. Those outcomes may be possible in broader research, but they should not be reported as confirmed without evidence from the vendor advisory or a verified technical analysis.
Exploitation Status
CVE-2026-49238 is not listed in the CISA Known Exploited Vulnerabilities catalog according to the supplied lookup. No CISA addition date, remediation deadline, or ransomware campaign flag applies. This means there is no CISA confirmation that the vulnerability is being exploited in the wild; it does not prove that exploitation is impossible or that private exploitation has not occurred.
The supplied NVD record and assessment do not confirm active exploitation. The correct current statement is: confirmed in-the-wild exploitation is not known from the supplied sources. Organizations should avoid describing this issue as an active exploitation campaign unless new evidence appears in a vendor notice, incident report, threat-intelligence feed, or CISA update.
A public GitHub Security Advisory exists: GHSA-rhp2-23c4-r34w. The advisory and associated technical description provide meaningful information about the vulnerable function, process privileges, procfs interaction, and SFTP frame injection. However, the available data does not establish that a separate public proof-of-concept repository exists.
Therefore, the defensible status is:
- Public advisory: Yes
- Separate verified public PoC repository: Not established
- Confirmed active exploitation: No
- CISA KEV listing: No
Detailed public technical information can reduce the time required to develop a working exploit. Treat unpatched shared Multipass hosts as higher risk even without a confirmed PoC, especially when guests run untrusted workloads.
Related Resources
Teams reviewing this issue may also benefit from our CVE-2026-47668 vulnerability analysis, particularly when comparing guest or application compromise paths with host-level exposure.
Sources
The primary technical references for this issue are the NVD record and Canonical’s GitHub Security Advisory. The NVD record identifies the product, affected version boundary, CVSS score, and vulnerability description. Its available response does not include the complete CVSS vector, so the vector should be verified before being quoted as authoritative.
Canonical’s advisory, GHSA-rhp2-23c4-r34w, is the principal vendor-linked source for the implementation details involving sshfs_server, validate_path, SFTP frame handling, and the host filesystem boundary. Administrators should consult the advisory for any later revisions, distribution-specific guidance, or additional mitigations.
- NVD: CVE-2026-49238
- Canonical Multipass GitHub Security Advisory: GHSA-rhp2-23c4-r34w
- CISA Known Exploited Vulnerabilities Catalog
CVE-2026-49238 is a high-severity guest-to-host filesystem disclosure issue, but it is not currently confirmed as actively exploited and is not listed in CISA KEV. Identify Multipass installations below 1.16.3 first, then upgrade to 1.16.3 or later. Until that work is complete, treat untrusted guests on vulnerable hosts as a potential path to host data exposure.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.
Detection Guidance
Detection should combine asset inventory, process inspection, filesystem telemetry, and guest compromise monitoring. Start by identifying every host running Multipass and recording the actual installed version. Do not rely solely on application inventory data, because package names and revisions can vary across operating systems and repositories.
On Linux systems, an initial version and process review may look like this:
multipass version
multipass list
pgrep -a -f 'multipass|sshfs_server'
The presence of sshfs_server is not itself malicious; it is an expected component in affected configurations. Investigators should instead correlate its activity with unexpected guest behavior, access to sensitive host paths, and unusual reads through procfs. A high-value alert is a guest-associated process attempting to inspect or write to another process’s file descriptors or standard streams, particularly when the target process is sshfs_server.
Example auditd rules for investigative coverage include:
-w /usr/bin/multipass -p x -k multipass_exec
-w /usr/sbin/multipassd -p x -k multipass_daemon
-w /proc -p r -k proc_access
The exact daemon path varies by installation, and broad /proc auditing can be noisy. Tune rules for the host’s actual Multipass binaries and use endpoint telemetry to identify access to paths such as /proc/<pid>/fd/0, /proc/<pid>/fd/1, or /proc/<pid>/fd/<n> where the target process resolves to sshfs_server.
A SIEM or endpoint query should look for the following behavioral pattern rather than a single guaranteed string:
process_name = "sshfs_server"
AND (
file_path LIKE "/etc/%"
OR file_path LIKE "/root/.ssh/%"
OR file_path LIKE "/home/%/.ssh/%"
OR file_path LIKE "/var/lib/%"
)
AND initiating_context IN ("multipass_guest", "guest_root", "unknown")
This is a hunting pattern, not a complete network signature. The exploit uses raw SFTP frames over process pipes rather than a conventional network request, so network IDS coverage may not observe the decisive activity. Review host file-access telemetry for sshfs_server reads outside the configured mount directory, and investigate any path containing traversal elements such as ../ before normalization.
Remediation Steps
Upgrade Canonical Multipass to 1.16.3 or later. The supplied affected-version statement identifies 1.16.3 as the fixed version. Where Multipass was installed through a distribution repository, confirm that the repository package includes the fix rather than assuming that the package’s publication date reflects the upstream version.
A generic package refresh should be adapted to the operating system and installation method. For an Ubuntu or Debian system using the package manager, administrators can first inspect the candidate version:
apt-cache policy multipass
multipass version
After confirming that the repository offers 1.16.3 or later, perform the normal package update:
sudo apt update
sudo apt install --only-upgrade multipass
multipass version
The exact package name or update mechanism may differ for Snap, distribution packages, or manually installed binaries. Use the Canonical Multipass distribution channel or package maintainer’s documented procedure, then verify the reported version after restarting any relevant Multipass services. If a vendor package reports a downstream revision without an obvious upstream version, obtain confirmation from the package maintainer that the CVE fix is included.
Until upgrade is complete, reduce exposure by preventing untrusted users from creating or controlling Multipass instances. Avoid running hostile or unreviewed workloads on vulnerable shared hosts, and separate CI jobs handling untrusted code from privileged developer workstations. Restrict access to the host, review procfs policy, and monitor Multipass processes for abnormal descriptor access. These measures reduce opportunity but do not replace the patch.
If immediate upgrade is impossible, the available information does not identify a complete vendor-supported workaround that eliminates the vulnerability. Do not claim that disabling a particular mount or network feature is sufficient unless Canonical documents it as a mitigation. The safest temporary posture is to stop running untrusted guests on affected hosts, isolate the host, and accelerate migration or upgrade.
After remediation, validate both the application version and operational state:
multipass version
multipass list
ps -eo user,pid,ppid,comm,args | grep -E '[m]ultipass|[s]shfs_server'
Retain evidence of the old version, upgrade transaction, final version, and any relevant package metadata. If a vulnerable host handled compromised workloads, investigate host credentials and sensitive files that may have been readable from the guest. Rotate exposed secrets according to their sensitivity and review authentication, cloud, source-control, and SSH logs for subsequent misuse.