CVE-2026-63299
An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.40%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil (Config == nil). An attacker can exploit these flaws to allocate storage resources that exceed the administrative limits configured for a project.
- CVSS 3.1
- 9.9 CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- EPSS
- 0.40% probability · 33th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-770
- Affected
- canonical/lxd
- Source
- security@ubuntu.com
References
- https://github.com/canonical/lxd/security/advisories/GHSA-5h78-p252-989hVendor Advisory, Exploit, Mitigation
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.