LXD 4.0.14 release notes

This is a LTS release and is recommended for production use.

Release notes content

These release notes cover updates in the core LXD repository and the LXD snap package.

This is a maintenance release for the 4.0 LTS series. It focuses on build reliability fixes backported from the main development branch.

Bug fixes

The following bug fixes are included in this release.

• Avoid pulling Go modules from Bazaar VCS during source builds

• Arbitrary file write on host via symlink in migration stream (CVE-2026-87799)

• btrfs optimized backup/migration: unvalidated subvolume path enables root arbitrary file delete/write (RCE ceiling) (CVE-2026-85185)

• Path traversal via btrfs optimized-backup subvolumes[].path enables root file/dir manipulation (CVE-2026-85526)

• Malicious agent in a VM can escape the target directory of a recursive file pull (CVE-2026-87798)

• CLI path traversal when exporting an image from a malicious server (CVE-2026-86334)

Change log

View the complete list of all changes in this release.

Downloads

The source tarballs and binary clients can be found on our download page.

Binary packages are also available for:

• Linux: snap install lxd --channel=4.0/stable

• macOS client: brew install lxc

• Windows client: choco install lxc