Canonical bug bounty programs
canonical.com Updated
Canonical runs two public programs: a Sorona bug bounty paying up to $1,500 and a Sorona bug bounty paying up to $1,500. It also owns ubuntu.com, which runs one more program.
- Top reward
- $1,500
- Sorona
- Programs
- 3
- 2 pay cash
- Targets in scope
- 39
- 3 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
2 programs Canonical runs itself, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
LXD
Sorona · The company-wide program. Pays up to $1,500.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
LXD
Sorona · Bug bounty |
– | – | – | $100 (highest) | $1,500 | Partial | – | – | Open |
|
Multipass
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100 (highest)
- Safe harbor
- Partial
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
Companies Canonical owns
1 company with 1 program of its own. Each has its own scope and rules: report to the one that owns the asset.
What is in scope
39 targets across all 3 programs, each listed once with the programs that cover it. 13 excluded.
-
Authentication and authorisation: TLS client certificates, OIDC, the trust store and the fine-grained permission model
Products and areas
Covered by LXD
-
Backup, export and restore, including archive creation, the helpers invoked and extraction
Products and areas
Covered by LXD
-
cloud-init handling and the instance configuration passed into a guest at launch
Products and areas
Covered by Multipass
-
Host mounts: the mapping of host directories into a guest and the path handling on both sides of that mapping
Products and areas
Covered by Multipass
-
Image download, signature verification and caching, including everything parsed out of a fetched image
Products and areas
Covered by Multipass
-
Image handling: import, unpacking, templates and the contents of any supplied image
Products and areas
Covered by LXD
-
Instance configuration for containers and virtual machines, covering devices, profiles and disk attachments
Products and areas
Covered by LXD
-
LXD takes reports through GitHub private vulnerability reporting on canonical/lxd, handled by the Ubuntu Security Team under Canonical's published disclosure and embargo policy. That policy governs process and credit rather than declaring a component boundary, so the whole product below is in scope
Products and areas
Covered by LXD
-
Migration and clustering, where one cluster member trusts another and accepts state from it
Products and areas
Covered by LXD
-
Multipass takes reports through GitHub private vulnerability reporting on canonical/multipass, handled under Canonical's published disclosure and embargo policy. That policy governs process and credit rather than declaring a component boundary, so the daemon, the client and every guest-facing service are in
Products and areas
Covered by Multipass
-
Networking setup, including bridge creation and any privileged host network change the daemon performs
Products and areas
Covered by Multipass
-
Networking: managed bridges, OVN integration, forwards and the firewall rules generated on the host
Products and areas
Covered by LXD
-
Projects and the restriction model separating one project's instances, networks and storage from another's
Products and areas
Covered by LXD
-
Storage drivers and volume handling in full, including attach, detach, custom volumes and snapshots
Products and areas
Covered by LXD
-
The alias and shell integration features, which run guest commands from a host context
Products and areas
Covered by Multipass
-
The built-in SFTP server and every file transfer and mount path it serves
Products and areas
Covered by Multipass
-
The exec, file transfer and console paths, where the daemon acts on a path inside a running instance
Products and areas
Covered by LXD
-
The gRPC interface between the client and the daemon, including its authentication and its authorisation checks
Products and areas
Covered by Multipass
-
The guest-facing DevLXD endpoint an instance can reach from inside itself
Products and areas
Covered by LXD
-
The installer and the update path on each of the three platforms
Products and areas
Covered by Multipass
-
The local settings store and any state the daemon reads from a location a less privileged user can write
Products and areas
Covered by Multipass
-
The lxc command-line client and the snap packaging that ships the daemon
Products and areas
Covered by LXD
-
The LXD daemon and its REST API in full, over both the local UNIX socket and the network listener
Products and areas
Covered by LXD
-
The multipassd daemon, which runs with elevated privilege on all three host platforms
Products and areas
Covered by Multipass
-
The virtual machine backends: QEMU on Linux, the Hyper-V and VirtualBox backends on Windows, and the macOS backend
Products and areas
Covered by Multipass
No target matches. Try part of a host name, such as the company name.
Out of scope 13
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
cveform.mitre.org
Self-hosted
-
Canonical or Ubuntu infrastructure and services
Self-hosted
-
Canonical's published cloud images rather than the code that fetches and verifies them
Multipass
-
Escapes from privileged containers, which the container runtime beneath LXD does not treat as root-safe
LXD
-
Findings that only reproduce on Incus, which is a separate project with separate reporting
LXD
-
Host platform hardening decisions, such as a developer disabling their own operating system's protections
Multipass
-
LXC and LXCFS defects below LXD, handled by the Linux Containers project under its own security page
LXD
-
Operator configuration that deliberately removes isolation, such as running an instance privileged or exposing the network listener to an untrusted network
LXD
-
QEMU, Hyper-V or VirtualBox defects rather than Multipass's configuration and use of them
Multipass
-
Snap or installer packaging issues outside the Multipass codebase
Multipass
-
software that is no longer supported
Self-hosted
-
Ubuntu guest operating system defects rather than Multipass
Multipass
-
Ubuntu kernel and QEMU defects rather than LXD's handling of them
LXD
Recent changes
Reward and scope changes across every Canonical program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Canonical products, from the NVD.
-
CVE-2026-66897 Critical
A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates the path against a confined os.Root directory handle but subsequently opens and creates the file using
-
CVE-2026-66897 Critical
A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates the path against a confined os.Root directory handle but subsequently opens and creates the file using
-
CVE-2026-66898 Critical
A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploit this flaw by supplying a crafted backup archive with malicious instance or volume names containing pa
-
CVE-2026-66898 Critical
A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploit this flaw by supplying a crafted backup archive with malicious instance or volume names containing pa
-
CVE-2026-16033 High
A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory (specifically affecting virtual machine / QEMU driver execution paths). An attacker can exploit this flaw by providing a cr
-
CVE-2026-13476 High
IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute arbitrary commands with service account privileges on the system due to improper validation of user supplied input.
-
CVE-2026-13476 High
IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute arbitrary commands with service account privileges on the system due to improper validation of user supplied input.
-
CVE-2026-16033 High
A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory (specifically affecting virtual machine / QEMU driver execution paths). An attacker can exploit this flaw by providing a cr
About this page
This page gathers every public program listed under canonical.com and the companies Canonical owns: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test. Ownership comes from settled, public acquisitions, or from a program's own text naming Canonical.
Something wrong or missing? Report a correction.