CVE-2026-63297

Awaiting Analysis Awaiting Analysis - Queue

LXD Authorization Bypass via TOCTOU in Cross-Project Instance Copies

Publication date: 2026-08-12

Last updated on: 2026-08-28

Assigner: Canonical Ltd.

Description

An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction checks before configuration merging is complete, creating a time-of-check to time-of-use (TOCTOU) condition. An attacker can exploit this flaw to copy instances with disallowed high-privilege configurations into restricted projects, bypassing security controls.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-28

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-63297

EUVD

EUVD-2026-57513

Affected Vendors & Products

Vendor	Product	Version / Range
ubuntu	lxd	*
canonical	lxd	From 5.0.0 (inc) to 6.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

Executive Summary

This is an authorization bypass vulnerability in LXD caused by a timing flaw during configuration merging. When copying an instance to a target project, LXD checks restrictions before configuration merging completes, creating a TOCTOU condition. An attacker can exploit this to bypass project restrictions and copy instances with high-privilege configurations into restricted projects.

Detection Guidance

Check LXD version with 'lxd --version' to confirm if your system is affected (versions >=5.0.0 and <6.9 are vulnerable). Review instance copy logs for cross-project operations to identify potential bypass attempts.

Impact Analysis

An authenticated attacker with access to an unrestricted project could copy an instance with dangerous configurations (like privileged containers) into a restricted project. This could lead to container escape, unauthorized access, or full system compromise, depending on the environment.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating confidentiality requirements in GDPR and HIPAA. It undermines access controls and segregation of duties, potentially resulting in non-compliance with data protection and security standards.

Mitigation Strategies

Upgrade LXD to version 6.9 or later immediately. Temporarily restrict cross-project instance copying until patched. Monitor for unauthorized privileged container creation in restricted projects.

Hi! I’m here to help you understand CVE-2026-63297. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70