Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-63296: LXD lets authenticated users move privileged containers into restricted projects

CVE-2026-63296 · published 2 months ago

Summary

The LXD container manager can be tricked by a signed‑in user to ignore project rules when moving a container. This lets the user place a container with powerful settings into a project that is supposed to block them, weakening the intended separation between projects. Install the latest LXD packages from your distribution or apply the vendor’s security update to resolve the problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	canonical	lxd	< 5.0.8 >= 5.0.0, < 5.0.8 >= 5.1, < 5.21.6 >= 6.0, < 6.10
Debian:12	debian	lxd	All versions
Debian:13	debian	lxd	All versions

Original advisory text

Project restriction bypass via instance migration config override

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without validating the new configuration against the target project's enforced restrictions. An attacker can exploit this flaw to move instances with disallowed high-privilege configurations into restricted projects, bypassing security controls.

References

https://security-tracker.debian.org/tracker/CVE-2026-63296 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63296... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-63296 Vendor Advisory
https://github.com/canonical/lxd/security/advisories/GHSA-gcr9-5q6r-w625 Vendor Advisory
https://github.com/canonical/lxd Product

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.9 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-863Incorrect Authorization

Timeline

Published12 Aug 2026

Updated4 Nov 2026

First seen12 Aug 2026

Sources

DEBIAN-CVE-2026-63296 · OSV

CVE-2026-63296 · NVD

CVE-2026-63296 · MITRE

CVE-2026-63296 · OSV

GHSA-gcr9-5q6r-w625 · GHSA

Track software like this

Free during beta