CVE-2026-63300

Last refreshed2026-10-23

Status: UPDATED | Advisory ID: CVE-2026-63300

Key Details

CVE	CVE-2026-63300
CVSS Score / Version	9.9 (Critical) / CVSS v3.1
Updated	2026-10-23
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`
CVSS Prose	attack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is changed; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	canonical lxd
Classified as	CWE-862 (Missing Authorization)

Affected Products, Subsystems & Sectors

Vendor	Product	Affected Versions	Patch Status
canonical	lxd

Vendor

Product

Affected Versions

Patch Status

canonical

lxd

Subsystems	General OT
Sectors	Multiple

What to Know

An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker with can_create_instances permissions on a restricted project to bypass project-level security restrictions. When migrating an instance between projects, LXD fails to validate the instance's configuration against the target project's enforced restrictions (such as restricted.containers.lowlevel, restricted.devices.*, and restricted.networks.access). An attacker can exploit this by creating a disallowed or high-privilege instance in an unrestricted project and subsequently moving it into the restricted project. (NVD)

What to Do

Monitor canonical's web page for any future patch releases. See vendor advisory link below.

References

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-63300
CVE	https://www.cve.org/CVERecord?id=CVE-2026-63300
Vendor advisory	https://github.com/canonical/lxd/security/advisories/GHSA-5g5r-wh97-qcq2

Source

Reference

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-63300

CVE

https://www.cve.org/CVERecord?id=CVE-2026-63300

Vendor advisory

https://github.com/canonical/lxd/security/advisories/GHSA-5g5r-wh97-qcq2