TI-2026-45145 Aliases CVE-2026-63299

Storage volume cross-project move and snapshot restore bypass project disk limits

MEDIUM 40CWE-770Published 2026-08-12 · Updated 2026-08-12

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil (Config == nil). An attacker can exploit these flaws to allocate storage resources that exceed the administrative limits configured for a project.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00588 48th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed LXD (Canonical): 5.0.8, 5.21.6, 6.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Canonical	LXD	5.0.0 to before 5.0.8; 5.21.0 to before 5.21.6; 6.0 to before 6.10	5.0.8, 5.21.6, 6.10	Patch available	CNA

LXD VendorCanonical Affected 5.0.0 to before 5.0.8; 5.21.0 to before 5.21.6; 6.0 to before 6.10 Fixed in 5.0.8, 5.21.6, 6.10 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:canonical:lxd::::::::	5.0.0 to before 5.0.8; 5.1 to before 5.21.6; 6.0 to before 6.10	Vulnerable	Canonical

cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:* Versions 5.0.0 to before 5.0.8; 5.1 to before 5.21.6; 6.0 to before 6.10 Vulnerable ·Canonical

Remediation

Fix · CNA LXD (Canonical) Fixed in 5.0.8, 5.21.6, 6.10

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-08-12
Canonical LXD 5.0.8, 5.21.6, 6.10
4 records Highest priority Priority HIGH 2 HIGH, 2 MEDIUM
Other records, highest priority first
- TI-2026-45146 Cross-project instance move bypasses all project restrictions allowing host command executionPriority HIGH 76
- TI-2026-45142 Project restriction bypass via instance migration config overridePriority HIGH 76
- TI-2026-44537 Cross-project cluster migration bypasses project restrictions via cluster notification flagPriority MEDIUM 44
Show all 4 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-63299

References

Exploit 1

https://github.com/canonical/lxd/security/advisories/GHSA-5h78-p252-989h

TI-2026-22659 Authenticated RCE via unsanitized compression_algorithm CVSS 4.0CRITICAL 9.4
TI-2026-47475 Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE CVSS 3.1CRITICAL 9.9
TI-2026-45146 Cross-project instance move bypasses all project restrictions allowing host command execution CVSS 3.1CRITICAL 9.9
TI-2026-45143 Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge CVSS 3.1CRITICAL 9.9
TI-2026-45142 Project restriction bypass via instance migration config override CVSS 3.1CRITICAL 9.9
TI-2026-45140 Root RCE via image backup.yaml symlink CVSS 3.1CRITICAL 9.9

See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences