CVE-2026-63297 PUBLISHED

Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge

Assigner: canonical
Reserved: 16.07.2026 Published: 12.08.2026 Updated: 13.08.2026

An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction checks before configuration merging is complete, creating a time-of-check to time-of-use (TOCTOU) condition. An attacker can exploit this flaw to copy instances with disallowed high-privilege configurations into restricted projects, bypassing security controls.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 9.9

Product Status

Vendor Canonical
Product LXD
Versions Default: unaffected
  • affected from 5.0.0 to 5.0.8 (excl.)
  • affected from 5.21.0 to 5.21.6 (excl.)

Solutions

Upgrade to LXD version 5.0.8 or later, or 5.12.6 or later.

References

Problem Types

  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition CWE
  • CWE-863 Incorrect Authorization CWE

Impacts

  • Accessing Functionality Not Properly Constrained by ACLs
  • Privilege Abuse
  • Privilege Escalation