CVE-2026-63300 Canonical CVE debrief

Who should care

LXD administrators, users with can_create_instances permissions on restricted projects, and security teams responsible for monitoring instance migration activities should be aware of this vulnerability. These stakeholders should review and update instance migration configurations to ensure proper validation against target project restrictions, restrict instance creation and migration permissions, and implement compensating controls to detect and prevent unauthorized instance migrations.

Technical summary

The instancePostMigration function in LXD's lxd/instance_post.go does not properly validate instance configurations against target project restrictions. An authenticated attacker with can_create_instances permissions on a restricted project can exploit this by creating a disallowed instance in an unrestricted project and migrating it to the restricted project. This vulnerability allows attackers to bypass project-level security restrictions, potentially leading to unauthorized access or elevated privileges.

Defensive priority

Authenticated attackers with can_create_instances permissions on restricted projects may bypass security restrictions by migrating instances with disallowed configurations.

Recommended defensive actions

• Review and update instance migration configurations to ensure proper validation against target project restrictions.
• Restrict instance creation and migration permissions to minimize potential attack surfaces.
• Monitor instance configurations and migration activities for suspicious behavior.
• Implement compensating controls to detect and prevent unauthorized instance migrations.
• Verify and apply vendor-provided patches or updates to address the vulnerability.

Evidence notes

The CVE record and NVD entry provide details on the improper validation vulnerability in LXD's instancePostMigration function. Evidence is based on official CVE and NVD records, as well as limited source references. To verify and mitigate this vulnerability, defenders should review instance migration configurations, validate instance configurations against target project restrictions, and monitor instance migration activities for suspicious behavior. Additionally, defenders should consider implementing compensating controls to detect and prevent unauthorized instance migrations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.