CVE-2026-63296: An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating…

PriorityP262critical9.9CVSS 3.1

AVNACLPRLUINSCCHIHAH

EPSS

0.25%

15.8th percentile

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without validating the new configuration against the target project's enforced restrictions. An attacker can exploit this flaw to move instances with disallowed high-privilege configurations into restricted projects, bypassing security controls.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
canonical	lxd	>= 5.0.0 < 5.0.8	5.0.8
canonical	lxd	>= 5.21.0 < 5.21.6	5.21.6
canonical	lxd	>= 6.0 < 6.10	6.10

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.