- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 13
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
13 assets you may test, 5 excluded.
Web 1
- https://canonical.com/multipass
Products and areas 12
- cloud-init handling and the instance configuration passed into a guest at launch
- Host mounts: the mapping of host directories into a guest and the path handling on both sides of that mapping
- Image download, signature verification and caching, including everything parsed out of a fetched image
- Multipass takes reports through GitHub private vulnerability reporting on canonical/multipass, handled under Canonical's published disclosure and embargo policy. That policy governs process and credit rather than declaring a component boundary, so the daemon, the client and every guest-facing service are in
- Networking setup, including bridge creation and any privileged host network change the daemon performs
- The alias and shell integration features, which run guest commands from a host context
- The built-in SFTP server and every file transfer and mount path it serves
- The gRPC interface between the client and the daemon, including its authentication and its authorisation checks
- The installer and the update path on each of the three platforms
- The local settings store and any state the daemon reads from a location a less privileged user can write
- The multipassd daemon, which runs with elevated privilege on all three host platforms
- The virtual machine backends: QEMU on Linux, the Hyper-V and VirtualBox backends on Windows, and the macOS backend
Out of scope (5)
- Canonical's published cloud images rather than the code that fetches and verifies them
- Host platform hardening decisions, such as a developer disabling their own operating system's protections
- QEMU, Hyper-V or VirtualBox defects rather than Multipass's configuration and use of them
- Snap or installer packaging issues outside the Multipass codebase
- Ubuntu guest operating system defects rather than Multipass
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Report through GitHub private vulnerability reporting on canonical/multipass, the channel the project names
-
Handling follows Canonical's published disclosure and embargo policy, the same one that states Canonical does not pay for bug reports
-
Name the host platform. multipassd runs privileged on Windows, macOS and Linux with a different privilege model on each, and the Windows and macOS sides see far less independent research
-
Name the VM backend too. QEMU on Linux, Hyper-V and VirtualBox on Windows and the macOS backend are separate code paths
-
For an escape, state exactly which channel carried it: a host mount, the SFTP transfer path, an alias invocation or the guest console
-
Credit runs through the CVE assignment and the Ubuntu Security Notice with real names by default. Say up front if you want a handle or no credit
-
Give the version and the installation method, since the snap, the Windows installer and the macOS package differ in how the daemon is privileged
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-66897 | A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates the path against a confined os.Root directory handle but subsequently opens and creates the file using | Critical 9.9 | 24 Aug 2026 |
| CVE-2026-66898 | A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploit this flaw by supplying a crafted backup archive with malicious instance or volume names containing pa | Critical 9.9 | 12 Aug 2026 |
| CVE-2026-13476 | IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute arbitrary commands with service account privileges on the system due to improper validation of user supplied input. | High 7.3 | 12 Aug 2026 |
| CVE-2026-16033 | A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory (specifically affecting virtual machine / QEMU driver execution paths). An attacker can exploit this flaw by providing a cr | High 8.5 | 12 Aug 2026 |
| CVE-2026-13367 | IBM Informix Dynamic Server 14.10, and 15.0 contain a local privilege escalation vulnerability in the oninit setuid-root utility. | High 7.8 | 12 Aug 2026 |
| CVE-2026-63297 | An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction checks before configuration merging is complete, creating a time-of-check to time-of-use (TOCTOU) condition. An attacker can | Critical 9.9 | 12 Aug 2026 |
| CVE-2026-63298 | An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration values, an attacker can manipulate the generated lxc.conf file. This flaw enables the attacker to execut | Critical 9.9 | 12 Aug 2026 |
| CVE-2026-63299 | An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check | Critical 9.9 | 12 Aug 2026 |
| CVE-2026-63300 | An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker with can_create_instances permissions on a restricted project to bypass project-level security restrictions. When migrating an instance between projects, LXD fails to validate the instance's configuration against the target project's enforced restrictions (such | Critical 9.9 | 12 Aug 2026 |
| CVE-2026-62420 | An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/{name} with migration: true, project: <target>, and target: <member>, the destination node skips all project restriction checks because the r | Critical 9.9 | 12 Aug 2026 |
| CVE-2026-63293 | A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a crafted image archive with a symlinked metadata.yaml file pointing to target file paths on the host sys | Critical 9.9 | 12 Aug 2026 |
| CVE-2026-63294 | A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can exploit this flaw by providing a malicious archive with a symlinked backup.yaml file, causing LXD to proce | Critical 9.9 | 12 Aug 2026 |
| CVE-2026-63295 | An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges (such as enforcing restricted.containers.privilege=isolated), LXD fails to enforce the requirement if an instance configuration omits the security.idmap.isolated key. An attacker can exploit th | Medium 4.3 | 12 Aug 2026 |
| CVE-2026-63296 | An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without validating the new configuration against the target project's enforced restrictions. An attacker can exploit this flaw to move instances with disallowed high-privile | Critical 9.9 | 12 Aug 2026 |
| CVE-2026-28385 | In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users with the can_create_images entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a URL source, the LXD daemon fails to validate or restrict outbound destination IP addresses, allowin | Medium 5.0 | 26 Jun 2026 |
| CVE-2026-9639 | Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause a denial of service via a specially crafted custom-volume backup tarball that omits the expires_at snapshot field. | Medium 6.5 | 26 Jun 2026 |
| CVE-2026-9640 | A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy restrictions by importing a maliciously crafted instance backup containing restricted configuration keys | High 7.2 | 26 Jun 2026 |
| CVE-2026-12411 | Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled. | High 8.4 | 26 Jun 2026 |
| CVE-2026-47337 | Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops. | Low 3.3 | 28 May 2026 |
| CVE-2026-47330 | Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling code. The bug can be triggered by an unprivileged local user and can result in the incorrect caching of AppArmor notification responses. | Low 3.3 | 28 May 2026 |
| CVE-2026-47331 | Ubuntu Linux 6.8 contains AppArmor SAUCE patches which fail to acquire a lock when modifying a linked list. An unprivileged local user could trigger the race condition that can lead to a use-after-free (UAF) and, theoretically, arbitrary code execution. | High 7.8 | 28 May 2026 |
| CVE-2026-47332 | Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in information disclosure from adjacent slab objects. | Medium 5.5 | 28 May 2026 |
| CVE-2026-47333 | Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine. | High 7.8 | 28 May 2026 |
| CVE-2026-47334 | Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be triggered by an unprivileged local user and can result in kernel panic or deadlock. | Medium 5.5 | 28 May 2026 |
| CVE-2026-47335 | Ubuntu Linux 6.8 contains SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel panic. | Medium 5.5 | 28 May 2026 |
| CVE-2026-47336 | Ubuntu Linux 6.8 contains SAUCE patches with a possible use of an uninitialized variable in AppArmor AF_INET/AF_INET6 socket mediation code. The bug can be triggered by an unprivileged local user and could result in incorrect fine-grained mediation of network sockets. | Low 3.3 | 28 May 2026 |
| CVE-2026-47328 | Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion. | Medium 6.1 | 28 May 2026 |
| CVE-2026-47329 | Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be triggered by an unprivileged local user and could result in handling of crafted responses. | Low 3.3 | 28 May 2026 |
| CVE-2026-47326 | Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can be triggered by an unprivileged local user. The memory leak could lead to resource exhaustion. | Medium 5.5 | 28 May 2026 |
| CVE-2026-47327 | Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops. | Low 3.3 | 28 May 2026 |
| CVE-2026-49237 | An issue was discovered in Canonical Multipass for macOS before version 1.16.3 due to an incomplete fix for CVE-2025-5199. While the patch in version 1.16.0 updated the ownership of the multipassd daemon binary to root:wheel, five co-located binaries (multipass, qemu-img, qemu-system-aarch64, qemu-system-x86_64, and sshfs_server) in /Library/Application Support/com.canonical.multipass/bin/ retain | High 7.8 | 28 May 2026 |
| CVE-2026-49238 | An issue was discovered in Canonical Multipass before version 1.16.3. The host-side SFTP server component (sshfs_server), which executes with root privileges on the host, contains a path containment bypass vulnerability within its validate_path function in src/sshfs_mount/sftp_server.cpp. The function performs a plain string prefix comparison on requested paths without path separator validation or | High 8.4 | 28 May 2026 |
| CVE-2018-25306 | PDFunite 0.41.0 contains a buffer overflow vulnerability that allows local attackers to crash the application by processing malformed PDF files during merge operations. Attackers can trigger a segmentation fault in the XRef::getEntry function within libpoppler by providing a specially crafted PDF file to the pdfunite utility. | Medium 6.9 | 29 Apr 2026 |
| CVE-2026-31431 | In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy | High 7.8 | 22 Apr 2026 |
| CVE-2026-6369 | An improper access control vulnerability in the canonical-livepatch snap client prior to version 10.15.0 allows a local unprivileged user to obtain a sensitive, root-level authentication token by sending an unauthenticated request to the livepatchd.sock Unix domain socket. This vulnerability is exploitable on systems where an administrator has already enabled the Livepatch client with a valid Ubun | Medium 5.7 | 20 Apr 2026 |
| CVE-2026-5412 | In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privileged user to access sensitive credentials. This issue is resolved in Juju versions 2.9.57 and 3.6.21. | Critical 9.9 | 10 Apr 2026 |
| CVE-2026-5774 | Improper synchronization of the userTokens map in the API server in Canonical Juju 4.0.5, 3.6.20, and 2.9.56 may allow an authenticated user to possibly cause a denial of service on the server or possibly reuse a single-use discharge token. | Medium 6.0 | 10 Apr 2026 |
| CVE-2025-15480 | In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, ubuntu-desktop-provision could include the user's password hash in the attached logs. | Low 2.7 | 9 Apr 2026 |
| CVE-2025-14551 | In Ubuntu, Subiquity version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, Subiquity could include certain user credentials, such as the user's plaintext Wi-Fi password, in the attached logs. | Low 2.7 | 9 Apr 2026 |
| CVE-2026-34177 | Canonical LXD versions 4.12 through 6.7 contain an incomplete denylist in isVMLowLevelOptionForbidden (lxd/project/limits/permissions.go), which omits raw.apparmor and raw.qemu.conf from the set of keys blocked under the restricted.virtual-machines.lowlevel=block project restriction. A remote attacker with can_edit permission on a VM instance in a restricted project can inject an AppArmor rule and | Critical 9.1 | 9 Apr 2026 |
| CVE-2026-34178 | In Canonical LXD before 6.8, the backup import path validates project restrictions against backup/index.yaml in the supplied tar archive but creates the instance from backup/container/backup.yaml, a separate file in the same archive that is never checked against project restrictions. An authenticated remote attacker with instance-creation permission in a restricted project can craft a backup archi | Critical 9.1 | 9 Apr 2026 |
| CVE-2026-34179 | In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate the Type field when handling PUT/PATCH requests to /1.0/certificates/{fingerprint} for restricted TLS certificate users, allowing a remote authenticated attacker to escalate privileges to cluster admin. | Critical 9.1 | 9 Apr 2026 |
| CVE-2025-68152 | Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators called ‘charms’. From versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19, it is possible that a compromised workload machine under a Juju controller can read any log file for any entity in any model at any level. This issue has been patched | Medium 6.9 | 3 Apr 2026 |
| CVE-2025-68153 | Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators called ‘charms’. From versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19, any authenticated user, machine or controller under a Juju controller can modify the resources of an application within the entire controller. This issue has been pat | High 7.1 | 3 Apr 2026 |
| CVE-2026-4370 | A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4.0.4, where the internal Dqlite database cluster fails to perform proper TLS client and server authentication. Specifically, the Juju controller's database endpoint does not validate client certificates when a new node attempts to join the cluster. An unauthenticated attacker with network reachabilit | Critical 10.0 | 1 Apr 2026 |
| CVE-2026-32694 | In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret owner relies exclusively on a predictable XID of the secret to verify ownership. This allows a malicious grantee which can request secrets to predict past secrets granted by the same secret owner to different grantees, allowing them to use the resources granted by those past secre | Medium 6.6 | 18 Mar 2026 |
| CVE-2026-32692 | An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3.1.6 through 3.6.18 allows an authenticated unit agent to perform unauthorized updates to secret revisions. With sufficient information, an attacker can poison any existing secret revision within the scope of that Vault secret back-end. | High 7.6 | 18 Mar 2026 |
| CVE-2026-32693 | In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is not performed correctly, which allows a grantee to update the secret content, and can lead to reading or updating other secrets. When the "secret-set" tool logs an error in an exploitation attempt, the secret is still updated contrary to expectations, and the new value is visible to both the owner and the gran | High 8.8 | 18 Mar 2026 |
| CVE-2026-32691 | A race condition in the secrets management subsystem of Juju versions 3.0.0 through 3.6.18 allows an authenticated unit agent to claim ownership of a newly initialized secret. Between generating a Juju Secret ID and creating the secret's first revision, an attacker authenticated as another unit agent can claim ownership of a known secret. This leads to the attacking unit being able to read the con | Medium 5.3 | 18 Mar 2026 |
| CVE-2026-3888 | Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS. | High 7.8 | 17 Mar 2026 |
| CVE-2026-3497 | Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange t | Medium 6.9 | 12 Mar 2026 |
| CVE-2026-28384 | An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the snap versions 5.0.6-e49d9f4 (channel 5.0/stable), 5.21.4-1374f39 (channel 5.21/stable), and 6.7-1f11451 | Critical 9.4 | 12 Mar 2026 |
| CVE-2026-3351 | Improper authorization in the API endpoint GET /1.0/certificates in Canonical LXD 6.6 on Linux allows an authenticated, restricted user to enumerate all certificate fingerprints trusted by the lxd server. | Low 2.1 | 3 Mar 2026 |
| CVE-2025-5467 | It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups. | Low 1.9 | 10 Dec 2025 |
| CVE-2025-6966 | NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key. | Medium 6.9 | 5 Dec 2025 |
| CVE-2025-33208 | NVIDIA TAO contains a vulnerability where an attacker may cause a resource to be loaded via an uncontrolled search path. A successful exploit of this vulnerability may lead to escalation of privileges, data tampering, denial of service, information disclosure. | High 8.8 | 3 Dec 2025 |
| CVE-2025-7044 | An Improper Input Validation vulnerability exists in the user websocket handler of MAAS. An authenticated, unprivileged attacker can intercept a user.update websocket request and inject the is_superuser property set to true. The server improperly validates this input, allowing the attacker to self-promote to an administrator role. This results in full administrative control over the MAAS deploymen | High 7.7 | 3 Dec 2025 |
| CVE-2025-54293 | Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attackers to read arbitrary files on the host system via crafted log file names or symbolic links. | High 7.1 | 2 Oct 2025 |
| CVE-2025-54292 | Path traversal in Canonical LXD LXD-UI versions before 6.5 and 5.21.4 on all platforms allows remote authenticated attackers to access or modify unintended resources via crafted resource names embedded in URL paths. | Medium 4.8 | 2 Oct 2025 |
| CVE-2025-54291 | Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses. | Medium 6.9 | 2 Oct 2025 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 2 Last 12 months Guest-to-host escape 40 % Path traversal 25 % Command injection 20 % Local privilege escalation 15 % Latest advisories Loading the feed Overview Multipass is Canonical's tool for running Ubuntu virtual machines on a developer's laptop, bundled through Canonical's developer tooling and installed on a very large number of Windows, macOS and Linux workstations. The host it runs on is a developer machine full of credentials and source code. CVE-2026-49238 is the reference point: a VM escape out of the built-in SFTP server through pipe injection and path traversal, breaking exactly the boundary a developer assumes is there. Canonical states in its published disclosure policy that it does not pay for bug reports in its software or its infrastructure. sorona.xyz pays you directly on qualified, reproduced findings. In scope Multipass takes reports through GitHub private vulnerability reporting on canonical/multipass, handled under Canonical's published disclosure and embargo policy. That policy governs process and credit rather than declaring a component boundary, so the daemon, the client and every guest-facing service are in The multipassd daemon, which runs with elevated privilege on all three host platforms The gRPC interface between the client and the daemon, including its authentication and its authorisation checks The built-in SFTP server and every file transfer and mount path it serves Host mounts: the mapping of host directories into a guest and the path handling on both sides of that mapping The virtual machine backends: QEMU on Linux, the Hyper-V and VirtualBox backends on Windows, and the macOS backend Image download, signature verification and caching, including everything parsed out of a fetched image cloud-init handling and the instance configuration passed into a guest at launch Networking setup, including bridge creation and any privileged host network change the daemon performs The alias and shell integration features, which run guest commands from a host context The installer and the update path on each of the three platforms The local settings store and any state the daemon reads from a location a less privileged user can write Out of scope Ubuntu guest operating system defects rather than Multipass QEMU, Hyper-V or VirtualBox defects rather than Multipass's configuration and use of them Host platform hardening decisions, such as a developer disabling their own operating system's protections Snap or installer packaging issues outside the Multipass codebase Canonical's published cloud images rather than the code that fetches and verifies them Most-valued findings Guest-to-host escape, ahead of everything else. CVE-2026-49238 got there through the SFTP server using pipe injection and path traversal, and on this product the host is a developer's own machine Path traversal in any mount or file transfer path, since mounting host directories into a guest is the normal workflow rather than an edge case Command or argument injection into anything the daemon executes on the host, given that the daemon holds elevated privilege on every platform Local privilege escalation on the host from an unprivileged user through the daemon's gRPC interface Image verification bypass, where a modified or substituted image is accepted and booted cloud-init and instance configuration handling that turns guest-side data into a host-side action Windows and macOS specific privilege defects, since the daemon's privilege model differs per platform and those two receive markedly less scrutiny than Linux Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report through GitHub private vulnerability reporting on canonical/multipass, the channel the project names Handling follows Canonical's published disclosure and embargo policy, the same one that states Canonical does not pay for bug reports Name the host platform. multipassd runs privileged on Windows, macOS and Linux with a different privilege model on each, and the Windows and macOS sides see far less independent research Name the VM backend too. QEMU on Linux, Hyper-V and VirtualBox on Windows and the macOS backend are separate code paths For an escape, state exactly which channel carried it: a host mount, the SFTP transfer path, an alias invocation or the guest console Credit runs through the CVE assignment and the Ubuntu Security Notice with real names by default. Say up front if you want a handle or no credit Give the version and the installation method, since the snap, the Windows installer and the macOS package differ in how the daemon is privileged Disclosure Coordinated by the Ubuntu Security Team through the GitHub private advisory workflow under Canonical's published embargo policy, published as a GitHub Security Advisory on canonical/multipass with a CVE assigned. Fixes reach users through the platform-specific installers and the snap, so the practical embargo runs to the coordinated release across all three host platforms rather than to a fixed day count. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability