CVE-2026-63296 PUBLISHED

Project restriction bypass via instance migration config override

Assigner: canonical
Reserved: 16.07.2026 Published: 12.08.2026 Updated: 13.08.2026

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without validating the new configuration against the target project's enforced restrictions. An attacker can exploit this flaw to move instances with disallowed high-privilege configurations into restricted projects, bypassing security controls.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 9.9

Product Status

Vendor Canonical
Product LXD
Versions Default: unaffected
  • affected from 5.0.0 to 5.0.8 (excl.)
  • affected from 5.21.0 to 5.21.6 (excl.)
  • affected from 6.0 to 6.10 (excl.)

Solutions

Upgrade to LXD version 5.0.8 or later, or 5.12.6 or later, or 6.10 or later.

References

Problem Types

  • CWE-863 Incorrect Authorization CWE

Impacts

  • Accessing Functionality Not Properly Constrained by ACLs
  • Privilege Abuse
  • Privilege Escalation