Auth Bypass in LXD Instance Migration
CVE-2026-63296 Published on August 12, 2026
Project restriction bypass via instance migration config override
An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without validating the new configuration against the target project's enforced restrictions. An attacker can exploit this flaw to move instances with disallowed high-privilege configurations into restricted projects, bypassing security controls.
Vulnerability Analysis
CVE-2026-63296 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Weakness Type
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-63296 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-63296
Want to know whenever a new CVE is published for Canonical Lxd? stack.watch will email you.
Affected Versions
Canonical LXD:- Version 5.0.0 and below 5.0.8 is affected.
- Version 5.21.0 and below 5.21.6 is affected.
- Version 6.0 and below 6.10 is affected.