Brief Summary: Canonical Multipass CVE-2026-49238 VM Escape via SFTP Path Traversal and Pipe Injection

Introduction

A path traversal flaw in Canonical Multipass's host side SFTP server lets a root user inside a guest virtual machine read arbitrary files on the host filesystem, which breaks VM isolation entirely. For development teams running Multipass on macOS with mounted directories, sensitive host credentials like SSH keys and cloud API tokens are directly accessible from within what was assumed to be a sandboxed environment.

Canonical Multipass is a lightweight VM manager for Linux, Windows, and macOS that lets developers spin up Ubuntu environments with a single command, using KVM on Linux, Hyper-V on Windows, and QEMU on macOS. The project has 9.1k stars and 795+ forks on GitHub. It is Canonical's recommended tool for local Ubuntu VM orchestration.

Technical Information

Root Cause: Flawed Path Validation

The vulnerability originates in the validate_path function at lines 226 through 232 of src/sshfs_mount/sftp_server.cpp in the Multipass source. This function is supposed to ensure that SFTP requests from the guest VM only access paths within the designated mount boundary on the host. The implementation does only a plain string prefix comparison on requested paths, with no path separator validation and no dot-dot (..) normalization.

So a path such as /Users/user/multipass_restrict/../.aws/credentials passes the prefix check, because its initial bytes match the allowed source path prefix. The operating system then resolves the .. traversal at ::open() time on the host, which escapes the mount boundary. This is a textbook CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) issue, a vulnerability class that MITRE and OWASP have documented at length with well established mitigations: canonicalize the path (resolve .., symlinks, and redundant separators) before comparing against the allowed directory, then verify the resolved path stays within the boundary.

The Pipe Injection Attack Vector

The technique bypasses the FUSE layer entirely. In normal operation, the sshfs_server process talks to the guest VM through stdin/stdout pipes using the raw SFTP binary protocol. After the SFTP handshake completes, a root process inside the guest can reach these pipes directly through the procfs filesystem at /proc/<sshfs_pid>/fd/1 (stdout) and /proc/<sshfs_pid>/fd/0 (stdin).

The sshfs_server process runs with root privileges on the host. That is what drives the severity: any path that passes the flawed validate_path check is then opened by a root process, so the attacker inherits full root file access on the host.

Step by Step Attack Flow

The GitHub advisory (GHSA-rhp2-23c4-r34w) describes a Python proof of concept script that demonstrates the full attack chain:

1. Obtain root in the guest: The default ubuntu user in a Multipass VM belongs to the sudo group with no password prompt. Privilege escalation within the guest is trivial.

2. Identify the sshfs PID: The attacker locates the process ID of the sshfs process running on the host but accessible from the guest.

3. Send SIGSTOP: The attacker sends SIGSTOP to the sshfs process, pausing its normal operation so it cannot interfere with the injected frames.

4. Inject raw SFTP frames: The attacker writes a malicious SSH_FXP_OPEN request directly into the sshfs process's stdin pipe via /proc/<sshfs_pid>/fd/0, with a path containing directory traversal sequences that match the allowed mount prefix.

5. Read the response: The attacker reads the file handle and file data from the sshfs process's stdout pipe via /proc/<sshfs_pid>/fd/1.

6. Complete the transaction: A full SSH_FXP_OPEN, SSH_FXP_READ, SSH_FXP_CLOSE transaction reads sensitive host files such as ~/.aws/credentials or ~/.ssh/id_rsa.

7. Send SIGCONT: The attacker resumes the sshfs process, restoring normal mount operation and leaving no artifact on the host.

Attack Prerequisites

The prerequisites for exploitation are low:

CVSS Vector Analysis

The CVSS v3.1 vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, scoring 8.4 (High).

The Scope: Changed designation matters most here. The vulnerability crosses the guest/host isolation boundary, which is the fundamental guarantee that VM technology is supposed to provide.

Defense in Depth Failure

This vulnerability fails at several layers at once. The validate_path function used string prefix matching rather than canonicalized path comparison. The SFTP binary protocol on stdin/stdout was exposed to the guest via procfs with no additional access controls. At the VM isolation layer, the default passwordless sudo configuration in the guest lowered the privilege barrier to near zero. The attack also leaves no artifact on the host filesystem, so host based monitoring alone may not detect exploitation.

Affected Systems and Versions

All versions of Canonical Multipass prior to version 1.16.3 are affected. The confirmed test environment in the advisory was macOS Tahoe 26.4.1 with Multipass 1.16.1+mac. The advisory notes that all versions of Multipass on macOS up to and including 1.16.2 are affected.

The vulnerability requires that a host directory has been mounted into the guest VM via multipass mount. Systems without mounted directories are not exploitable through this vector.

Multipass version 1.16.3 contains the fix, described in the release notes as "[sshfs] Sshfs path normalization." As of May 20, 2026, the release candidate v1.16.3-rc2 was available as a pre-release on GitHub.

Vendor Security History

Multipass has had a run of local privilege escalation vulnerabilities over the past five years:

All three CVEs share a theme: default configuration or implementation errors in boundary enforcement, rather than subtle cryptographic or logic flaws. macOS shows up as a repeated affected platform. The pattern suggests that Canonical's development process for Multipass would benefit from systematic threat modeling focused on the guest/host boundary, rather than surfacing these issues one bug at a time.

The researcher credited with discovering CVE-2026-49238 is @espreto, and the advisory was published by ricab on the GitHub security advisories page.

Canonical followed a responsible disclosure timeline: the 1.16.3 release candidate was published on May 20, 2026, eight days before the advisory went public on May 28, 2026.

References

• GHSA-rhp2-23c4-r34w: SFTP Server VM Escape via Pipe Injection and Path Traversal
• NVD: CVE-2026-49238
• Multipass GitHub Releases
• Multipass GitHub Repository
• CWE-22: Improper Limitation of a Pathname to a Restricted Directory
• OWASP: Path Traversal
• NVD: CVE-2025-5199 (Prior Multipass CVE)
• NVD: CVE-2021-3626 (Prior Multipass CVE)
• Huntress: The Great VM Escape: ESXi Exploitation in the Wild
• Google Security Research: Oracle VM VirtualBox VM Escape via VGA Device
• Ubuntu CVEs
• Ubuntu Security Notices
• Multipass Security Advisories