CVE-2021-3747

CVE-2021-3747 affects MacOS Multipass 1.7.0 where the application directory was installed with an incorrect owner; the issue is resolved by upgrading to 1.7.2 (per multiple sources including NVD and vendor advisories).

CVE-2021-3626

Multipass Windows prior to 1.7.0 is affected by a local privilege-escalation issue: any local process can connect to the localhost TCP control socket to perform mounts from the host OS to a guest. Impact is privilege escalation with high severity per CVSS. Remediation provided in public records i...

CVE-2025-5199

CVE-2025-5199 affects Canonical Multipass on macOS up to version 1.15.1. The flaw is due to incorrect default permissions, enabling a local attacker to escalate privileges by modifying files executed with administrative privileges by a Launch Daemon during system startup. Impact is high (local ac...

CVE-2026-49238

CVE-2026-49238 affects Canonical Multipass

CVE-2026-49237

Summary of CVE-2026-49237 : Canonical Multipass for macOS (before 1.16.3) is affected due to an incomplete fix for CVE-2025-5199. After the 1.16.0 patch, the multipassd daemon binary is owned by root:wheel, but five co-located binaries in /Library/Application Support/com.canonical.multipass/bin/ ...