Multipass (Canonical) - vulnerabilities (CVEs)

5 CVEs, 0 in the last 30 days, 92 known versions, newest CVE from 2026-05-28. Vendor: Canonical.

CVEs of Multipass

• CVE-2026-49238 - CVSS 8.4 (high), 2026-05-28: An issue was discovered in Canonical Multipass before version 1.16.3. The host-side SFTP server component (sshfs_server), which executes with root privileges…
• CVE-2026-49237 - CVSS 7.8 (high), 2026-05-28: An issue was discovered in Canonical Multipass for macOS before version 1.16.3 due to an incomplete fix for CVE-2025-5199. While the patch in version 1.16.0…
• CVE-2025-5199 - CVSS 7.8 (high), 2025-07-12: In Canonical Multipass up to and including version 1.15.1 on macOS, incorrect default permissions allow a local attacker to escalate privileges by modifying…
• CVE-2021-3747 - CVSS 8.8 (high), 2021-10-01: The MacOS version of Multipass, version 1.7.0, fixed in 1.7.2, accidentally installed the application directory with incorrect owner.
• CVE-2021-3626 - CVSS 8.8 (high), 2021-10-01: The Windows version of Multipass before 1.7.0 allowed any local process to connect to the localhost TCP control socket to perform mounts from the operating…