CVE-2026-63296: Canonical Lxd

Critical severity, CVSS 9.9. EPSS: 0.4% chance of exploitation in the next 30 days.

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without validating the new configuration against the target project's enforced restrictions. An attacker can exploit this flaw to move instances with disallowed high-privilege configurations into restricted projects, bypassing security controls.

Affected products

• Canonical Lxd: from 5.0.0, before 5.0.8 (fixed in 5.0.8); from 5.1, before 5.21.6 (fixed in 5.21.6); from 6.0, before 6.10 (fixed in 6.10)

Published 2026-08-12. Last modified 2026-09-11.