CVE-2026-63295: Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated`
An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges (such as enforcing restricted.containers.privilege=isolated), LXD fails to enforce the requirement if an instance configuration omits the security.idmap.isolated key. An attacker can exploit this flaw by creating or updating an instance without explicitly setting security.idmap.isolated, bypassing the target project's security constraints.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
lxdto a version that resolves this vulnerability.Fixed in 4.0.12 - Upgrade
Upgrade
lxdto a version that resolves this vulnerability.Fixed in 5.0.8 - Upgrade
Upgrade
lxdto a version that resolves this vulnerability.Fixed in 5.12.6 - Upgrade
Upgrade
lxdto a version that resolves this vulnerability.Fixed in 6.10
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63295?
The severity of CVE-2026-63295 is medium with a score of 4.3.
How do I fix CVE-2026-63295?
To fix CVE-2026-63295, ensure that the 'security.idmap.isolated' option is properly configured in your project settings.
What type of vulnerability is CVE-2026-63295?
CVE-2026-63295 is an authorization bypass vulnerability in Canonical LXD.
Who is affected by CVE-2026-63295?
Authenticated users with access to LXD can potentially exploit CVE-2026-63295 if project-level container isolation is not properly enforced.
What can an attacker do with CVE-2026-63295?
An attacker can bypass project-level container isolation restrictions, potentially leading to unauthorized access to privileged container settings.