CVE-2026-63297

Last refreshed2026-10-23

Status: UPDATED | Advisory ID: CVE-2026-63297

Key Details

CVE	CVE-2026-63297
CVSS Score / Version	9.9 (Critical) / CVSS v3.1
Updated	2026-10-23
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`
CVSS Prose	attack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is changed; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	canonical lxd
Classified as	CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition)

Affected Products, Subsystems & Sectors

Vendor	Product	Affected Versions	Patch Status
canonical	lxd

Vendor

Product

Affected Versions

Patch Status

canonical

lxd

Subsystems	General OT
Sectors	Multiple

What to Know

An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction checks before configuration merging is complete, creating a time-of-check to time-of-use (TOCTOU) condition. An attacker can exploit this flaw to copy instances with disallowed high-privilege configurations into restricted projects, bypassing security controls. (NVD)

What to Do

Monitor canonical's web page for any future patch releases. See vendor advisory link below.

References

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-63297
CVE	https://www.cve.org/CVERecord?id=CVE-2026-63297
Vendor advisory	https://github.com/canonical/lxd/security/advisories/GHSA-v989-qw7w-xvg4

Source

Reference

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-63297

CVE

https://www.cve.org/CVERecord?id=CVE-2026-63297

Vendor advisory

https://github.com/canonical/lxd/security/advisories/GHSA-v989-qw7w-xvg4