TI-2026-45142 Aliases CVE-2026-63296

Project restriction bypass via instance migration config override

HIGH 76CWE-863Published 2026-08-12 · Updated 2026-08-13

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without validating the new configuration against the target project's enforced restrictions. An attacker can exploit this flaw to move instances with disallowed high-privilege configurations into restricted projects, bypassing security controls.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00444 38th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed LXD (Canonical): 5.0.8, 5.21.6, 6.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Canonical	LXD	5.0.0 to before 5.0.8; 5.21.0 to before 5.21.6; 6.0 to before 6.10	5.0.8, 5.21.6, 6.10	Patch available	CNA

LXD VendorCanonical Affected 5.0.0 to before 5.0.8; 5.21.0 to before 5.21.6; 6.0 to before 6.10 Fixed in 5.0.8, 5.21.6, 6.10 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:canonical:lxd::::::::	5.0.0 to before 5.0.8; 5.1 to before 5.21.6; 6.0 to before 6.10	Vulnerable	Canonical

cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:* Versions 5.0.0 to before 5.0.8; 5.1 to before 5.21.6; 6.0 to before 6.10 Vulnerable ·Canonical

Remediation

Fix · CNA LXD (Canonical) Fixed in 5.0.8, 5.21.6, 6.10

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-08-12
Canonical LXD 5.0.8, 5.21.6, 6.10
4 records Highest priority Priority HIGH 2 HIGH, 2 MEDIUM
Other records, highest priority first
- TI-2026-45146 Cross-project instance move bypasses all project restrictions allowing host command executionPriority HIGH 76
- TI-2026-44537 Cross-project cluster migration bypasses project restrictions via cluster notification flagPriority MEDIUM 44
- TI-2026-45145 Storage volume cross-project move and snapshot restore bypass project disk limitsPriority MEDIUM 40
Show all 4 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-63296

References

Exploit 1

https://github.com/canonical/lxd/security/advisories/GHSA-gcr9-5q6r-w625

TI-2026-22659 Authenticated RCE via unsanitized compression_algorithm CVSS 4.0CRITICAL 9.4
TI-2026-47475 Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE CVSS 3.1CRITICAL 9.9
TI-2026-45146 Cross-project instance move bypasses all project restrictions allowing host command execution CVSS 3.1CRITICAL 9.9
TI-2026-45143 Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge CVSS 3.1CRITICAL 9.9
TI-2026-45140 Root RCE via image backup.yaml symlink CVSS 3.1CRITICAL 9.9
TI-2026-45139 Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root CVSS 3.1CRITICAL 9.9

See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences