CVE-2026-63299

Analyzed Analyzed - Analysis Complete

Authorization Bypass in LXD Allows Storage Limit Exploitation

Publication date: 2026-08-12

Last updated on: 2026-09-11

Assigner: Canonical Ltd.

Description

An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil (Config == nil). An attacker can exploit these flaws to allocate storage resources that exceed the administrative limits configured for a project.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-09-11

Generated

2026-09-22

AI Q&A

2026-08-13

EPSS Evaluated

2026-09-20

NVD

CVE-2026-63299

EUVD

EUVD-2026-57418

Affected Vendors & Products

Vendor	Product	Version / Range
canonical	lxd	From 5.0.0 (inc) to 5.0.8 (exc)
canonical	lxd	From 6.0 (inc) to 6.10 (exc)
canonical	lxd	From 5.1 (inc) to 5.21.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This is an authorization bypass vulnerability in LXD where authenticated users can exceed project-level disk and volume limits. Two code paths fail to check resource limits during volume operations: one when moving volumes across projects and another during snapshot restore operations when configuration is nil. This allows attackers to allocate excessive storage resources beyond administrative limits.

Detection Guidance

This vulnerability cannot be directly detected using commands as it involves logical flaws in authorization checks within LXD. However, you can verify if your LXD version is affected by checking the installed version against patched releases. Run: lxd --version. If the version is below the patched release, the system is vulnerable.

Impact Analysis

An attacker could exploit this to consume excessive storage resources in a shared environment, potentially causing denial of service for other users or projects. This may lead to degraded system performance, resource exhaustion, or unexpected costs if storage is metered.

Compliance Impact

This vulnerability allows unauthorized allocation of storage resources exceeding project limits, which could lead to unauthorized data storage or processing. This may violate compliance requirements under GDPR (data minimization, integrity) and HIPAA (access controls, integrity) by enabling unauthorized resource usage that could compromise data protection or audit integrity.

Mitigation Strategies

Update LXD to the latest patched version immediately to address the authorization bypass flaw. Review project-level disk and volume limits to ensure they are correctly configured. Monitor storage resource usage for any unauthorized allocations exceeding project limits.

Hi! I’m here to help you understand CVE-2026-63299. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70