CVE-2026-62420: An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance…

PriorityP262critical9.9CVSS 3.1

AVNACLPRLUINSCCHIHAH

EPSS

0.31%

23.0th percentile

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/{name} with migration: true, project: , and target: , the destination node skips all project restriction checks because the request arrives as an internal cluster notification. An attacker can exploit this to introduce disallowed instance configurations into a restricted project.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
canonical	lxd	>= 5.0.0 < 5.0.8	5.0.8
canonical	lxd	>= 5.21.0 < 5.21.6	5.21.6
canonical	lxd	>= 6.0 < 6.10	6.10

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.