Authorization Bypass in LXD by Canonical

CVE-2026-63299

What is CVE-2026-63299?

An authorization bypass vulnerability in LXD allows authenticated users to circumvent project-level disk and volume limits. This vulnerability arises from two specific code paths that fail to adequately enforce resource limits during volume operations. In particular, the 'storagePoolVolumeTypePostMove' function neglects the 'limits.AllowVolumeCreation' check prior to moving a volume across projects, while volume snapshot restore operations overlook the 'AllowVolumeUpdate' verification when the configuration is nil. As a result, an attacker could exploit these oversights to allocate storage resources that surpass the defined administrative limits for a project.

References