CVE-2026-63296

Received Received - Intake

Authorization Bypass in LXD During Instance Migration

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: Canonical Ltd.

Description

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without validating the new configuration against the target project's enforced restrictions. An attacker can exploit this flaw to move instances with disallowed high-privilege configurations into restricted projects, bypassing security controls.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-63296

EUVD

EUVD-2026-57515

Affected Vendors & Products

Vendor	Product	Version / Range
canonical	lxd	From 5.0 (inc)
canonical	lxd	5.0.8
canonical	lxd	5.21.6
canonical	lxd	6.10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This is an authorization bypass flaw in LXD where an authenticated attacker can bypass project restrictions during instance migration. By providing malicious configuration overrides during migration, the attacker can move instances with high-privilege settings into restricted projects, bypassing security controls.

Detection Guidance

To detect this vulnerability, check LXD versions for affected releases (>=5.0 and <5.0.8, <5.21.6, <6.10). Inspect logs for instance migration requests with configuration overrides like security.privileged or raw.lxc. Look for unauthorized project changes or privilege escalations in audit logs.

Impact Analysis

An attacker could exploit this to gain elevated privileges, create privileged containers, and escape to the host with root access. This could lead to full system compromise, data theft, or unauthorized access to sensitive resources.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection and privacy such as GDPR and HIPAA. It undermines security controls meant to protect regulated data.

Mitigation Strategies

Upgrade LXD to patched versions (5.0.8, 5.21.6, or 6.10). Restrict migration permissions to trusted users. Monitor project configurations for unauthorized changes. Disable instance migration if not required.

Hi! I’m here to help you understand CVE-2026-63296. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70