CVE-2026-63300 Canonical CVE debrief

Who should care

LXD administrators, security teams, and personnel responsible for managing instances and projects in LXD should be aware of this vulnerability and take necessary actions to mitigate it.

Why it matters

This vulnerability allows an authenticated attacker to bypass project-level security restrictions in LXD, potentially leading to unauthorized access or elevated privileges. LXD administrators and security teams should review and update instance configurations, implement additional monitoring and logging, and apply patches or updates provided by the vendor.

• Potential unauthorized access to restricted projects
• Elevation of privileges for authenticated attackers
• Bypassing of project-level security restrictions
• Possible data breaches or unauthorized data modifications

Technical summary

The vulnerability is caused by an improper validation in the instancePostMigration function in lxd/instance_post.go of LXD. This allows an authenticated attacker with can_create_instances permissions on a restricted project to bypass project-level security restrictions when migrating an instance between projects. The issue arises from LXD's failure to validate the instance's configuration against the target project's enforced restrictions. As a result, an attacker can exploit this by creating a disallowed or high-privilege instance in an unrestricted project and subsequently moving it into the restricted project, potentially leading to unauthorized access or elevated privileges.

Defensive priority

High

Recommended defensive actions

• Review and update LXD instance configurations to ensure compliance with project-level security restrictions.
• Implement additional monitoring and logging to detect potential exploitation attempts.
• Apply patches or updates provided by the vendor to address the vulnerability.
• Restrict instance migration between projects to authorized personnel only.
• Perform a thorough review of existing instances and their configurations to identify potential security risks.
• Update incident response plans to include procedures for addressing potential exploitation of this vulnerability.
• Conduct regular security audits to ensure that all instances are compliant with project-level security restrictions.

Evidence notes

The vulnerability is described in the CVE record and NVD vulnerability detail page. The source references include links to GitHub pull requests and a vendor advisory. Evidence is limited to public CVE and NVD information. Defenders should verify instance configurations, review project-level security restrictions, and monitor for potential exploitation attempts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.