CVE-2026-63296: Project restriction bypass via instance migration config override
An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without validating the new configuration against the target project's enforced restrictions. An attacker can exploit this flaw to move instances with disallowed high-privilege configurations into restricted projects, bypassing security controls.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.0.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.12.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.10
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63296?
The severity of CVE-2026-63296 is critical, with a CVSS score of 9.9.
How does CVE-2026-63296 affect LXD users?
CVE-2026-63296 allows an authenticated attacker to bypass project restrictions during instance migration, potentially leading to unauthorized access.
How can I mitigate CVE-2026-63296?
To mitigate CVE-2026-63296, ensure you apply patches released by Canonical for the vulnerable versions of LXD.
What type of attacks does CVE-2026-63296 facilitate?
CVE-2026-63296 facilitates authorization bypass attacks during instance migration in LXD.
When was CVE-2026-63296 published?
CVE-2026-63296 was published on August 12, 2026.