TI-2026-36438 CVE-2026-49238
SFTP Server VM Escape in Canonical Multipass
Priority HIGH 72
An issue was discovered in Canonical Multipass before version 1.16.3.
Canonical
Records4302All Threatist records
Exploited (KEV)47In CISA KEV
CVSS critical587CVSS 9.0–10.0
CVSS high1486CVSS 7.0–8.9
Exploited now
Canonical records in CISA KEVTI-2015-04610 ISC BIND Data Processing Errors Vulnerability TI-2022-00413 Linux Kernel Improper Authentication Vulnerability TI-2026-23989 Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability TI-2018-10499 Linux Kernel Integer Overflow Vulnerability TI-2025-23530 Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability TI-2023-00370 Linux Kernel Improper Ownership Management Vulnerability
Components
Products in the NVD configurations · select one to filter the recordsRecords
5 records in Multipass · all components
TI-2025-04665 CVE-2025-5199
LPE on Multipass for macOS
Priority HIGH 69
In Canonical Multipass up to and including version 1.15.1 on macOS, incorrect default permissions allow a local attacker to escalate privileges by modifying files executed with administrative privileges by a Launch Daemo…
TI-2021-02680 CVE-2021-3747 · GHSA-63mg-hhpp-mqfx
MacOS version of Multipass incorrect owner for application directory
Priority LOW 38
The MacOS version of Multipass, version 1.7.0, fixed in 1.7.2, accidentally installed the application directory with incorrect owner.
TI-2021-02572 CVE-2021-3626 · GHSA-68wj-3pj9-r3hp
Windows version of Multipass unauthenticated localhost tcp control socket can perform mounts
Priority LOW 38
The Windows version of Multipass before 1.7.0 allowed any local process to connect to the localhost TCP control socket to perform mounts from the operating system to a guest, allowing for privilege escalation.
Priority LOW 35
An issue was discovered in Canonical Multipass for macOS before version 1.16.3 due to an incomplete fix for CVE-2025-5199.