Authorization Bypass Vulnerability in LXD by Canonical

CVE-2026-63297

What is CVE-2026-63297?

An authorization bypass vulnerability in LXD arises from a timing flaw during the configuration merging process. This flaw enables an authenticated attacker to circumvent target project restrictions when copying instances across projects. Specifically, LXD performs security checks before the completion of configuration merging, resulting in a time-of-check to time-of-use (TOCTOU) condition. Consequently, an attacker can exploit this vulnerability to transfer instances with high-privilege configurations into restricted projects, effectively bypassing established security controls.

References