CVE-2026-63299 Canonical CVE debrief

Who should care

Defenders responsible for LXD deployments, particularly those with multi-project environments, should assess exposure and prioritize patching to prevent potential storage resource limit bypasses.

Why it matters

Defenders should care about CVE-2026-63299 because it allows authenticated users to bypass project-level disk and volume limits in LXD, potentially leading to unauthorized storage resource allocation. LXD deployment administrators should assess exposure, especially in multi-project environments, and prioritize patching to prevent potential storage resource limit bypasses. The impact is critical, with a CVSS score of 9.9.

• Potential unauthorized storage resource allocation
• Bypass of project-level disk and volume limits
• Possible data storage beyond administrative limits

Technical summary

The vulnerability allows an authenticated user to bypass project-level disk and volume limits in LXD due to two related code paths failing to verify resource limits during volume operations. Specifically, the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil (Config == nil). This could lead to unauthorized storage resource allocation, allowing an attacker to allocate storage resources that exceed the administrative limits configured for a project.

Defensive priority

Defenders should prioritize verifying LXD versions and applying vendor patches to prevent potential storage resource limit bypasses.

Recommended defensive actions

• Verify LXD versions and apply vendor patches
• Review project-level disk and volume limits
• Monitor for suspicious volume operations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and vendor advisories. Evidence is limited to public CVE and NVD information. Defenders should verify LXD versions, review project-level limits, and monitor for suspicious volume operations to address potential exposure. The vulnerability allows authenticated users to bypass project-level disk and volume limits, potentially leading to unauthorized storage resource allocation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.