TI-2026-44537 Aliases CVE-2026-62420

Cross-project cluster migration bypasses project restrictions via cluster notification flag

MEDIUM 44CWE-863Published 2026-08-12 · Updated 2026-08-12

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/{name} with migration: true, project: <target>, and target: <member>, the destination node skips all project restriction checks because the request arrives as an internal cluster notification. An attacker can exploit this to introduce disallowed instance configurations into a restricted project.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00539 45th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed LXD (Canonical): 5.0.8, 5.21.6, 6.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Canonical	LXD	5.0.0 to before 5.0.8; 5.21.0 to before 5.21.6; 6.0 to before 6.10	5.0.8, 5.21.6, 6.10	Patch available	CNA

LXD VendorCanonical Affected 5.0.0 to before 5.0.8; 5.21.0 to before 5.21.6; 6.0 to before 6.10 Fixed in 5.0.8, 5.21.6, 6.10 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:canonical:lxd::::::::	5.0.0 to before 5.0.8; 5.1 to before 5.21.6; 6.0 to before 6.10	Vulnerable	Canonical

cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:* Versions 5.0.0 to before 5.0.8; 5.1 to before 5.21.6; 6.0 to before 6.10 Vulnerable ·Canonical

Remediation

Fix · CNA LXD (Canonical) Fixed in 5.0.8, 5.21.6, 6.10

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-08-12
Canonical LXD 5.0.8, 5.21.6, 6.10
4 records Highest priority Priority HIGH 2 HIGH, 2 MEDIUM
Other records, highest priority first
- TI-2026-45146 Cross-project instance move bypasses all project restrictions allowing host command executionPriority HIGH 76
- TI-2026-45142 Project restriction bypass via instance migration config overridePriority HIGH 76
- TI-2026-45145 Storage volume cross-project move and snapshot restore bypass project disk limitsPriority MEDIUM 40
Show all 4 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-62420

References

Exploit 1

https://github.com/canonical/lxd/security/advisories/GHSA-v9wr-9r7q-fh4g

Patch 2

TI-2026-22659 Authenticated RCE via unsanitized compression_algorithm CVSS 4.0CRITICAL 9.4
TI-2026-47475 Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE CVSS 3.1CRITICAL 9.9
TI-2026-45146 Cross-project instance move bypasses all project restrictions allowing host command execution CVSS 3.1CRITICAL 9.9
TI-2026-45143 Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge CVSS 3.1CRITICAL 9.9
TI-2026-45142 Project restriction bypass via instance migration config override CVSS 3.1CRITICAL 9.9
TI-2026-45140 Root RCE via image backup.yaml symlink CVSS 3.1CRITICAL 9.9

See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences