High severity · published Oct 1, 2021
CVE-2021-3626
The Windows version of Multipass before 1.7.0 allowed any local process to connect to the localhost TCP control socket to perform mounts from the operating system to a guest,…
8.8
CVSS
0.2%
EPSS
No
On KEV
Description
The Windows version of Multipass before 1.7.0 allowed any local process to connect to the localhost TCP control socket to perform mounts from the operating system to a guest, allowing for privilege escalation.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MU
Multipass · Canonical
before 1.7.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-3626
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-3626
Patch
https://github.com/canonical/multipass/pull/2150
More from Multipass
8.4
CVE-2026-49238
SFTP Server VM Escape in Canonical Multipass
7.8
CVE-2026-49237
Local Privilege Escalation in Canonical Multipass
7.8
CVE-2025-5199
LPE on Multipass for macOS
7.8
CVE-2021-3747
The MacOS version of Multipass, version 1.7.0, fixed in 1.7.2, accidentally installed the application directory with incorrect owner