CVE-2026-63300

Awaiting Analysis Awaiting Analysis - Queue

Privilege Escalation in LXD via Instance Migration

Publication date: 2026-08-12

Last updated on: 2026-08-28

Assigner: Canonical Ltd.

Description

An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker with can_create_instances permissions on a restricted project to bypass project-level security restrictions. When migrating an instance between projects, LXD fails to validate the instance's configuration against the target project's enforced restrictions (such as restricted.containers.lowlevel, restricted.devices.*, and restricted.networks.access). An attacker can exploit this by creating a disallowed or high-privilege instance in an unrestricted project and subsequently moving it into the restricted project.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-28

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-63300

EUVD

EUVD-2026-57411

Affected Vendors & Products

Vendor	Product	Version / Range
ubuntu	lxd	*
canonical	lxd	From 5.0\|end_including=6.9 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in LXD allows an authenticated attacker with specific permissions to bypass project-level security restrictions when migrating an instance between projects. The flaw occurs because the instancePostMigration function fails to validate the instance's configuration against the target project's enforced restrictions, such as device or network access controls.

Detection Guidance

To detect this vulnerability, check LXD versions between 5.0 and 6.9. Run 'lxd --version' to verify the installed version. Inspect logs for unauthorized instance migrations between projects, especially involving restricted configurations like raw.lxc, raw.qemu, or privileged settings. Look for instances with forbidden devices such as unix-char or disk mounts with host paths.

Impact Analysis

An attacker could exploit this to move a malicious instance from an unrestricted project to a restricted one. This could lead to arbitrary root command execution on the host, unauthorized access to the host filesystem, or hardware access via unrestricted devices, effectively bypassing all project security measures.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating compliance requirements such as GDPR's data protection principles or HIPAA's security rules. Bypassing project restrictions may result in unauthorized data exposure or system access, posing significant compliance risks.

Mitigation Strategies

Upgrade LXD to a patched version immediately. Temporarily restrict can_create_instances permissions to trusted users. Audit existing instances for suspicious configurations or unauthorized migrations. Disable instance migration between projects until patched. Monitor for unusual activity in project restrictions or instance configurations.

Hi! I’m here to help you understand CVE-2026-63300. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70