CVEvulnerability

CVE-2026-63295

4.3 MEDIUM Published 2026-08-12 Modified 2026-10-24 Official page ↗
Status
Analyzed
Published
2026-08-12
Last modified
2026-10-24
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-863

Description

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges (such as enforcing restricted.containers.privilege=isolated), LXD fails to enforce the requirement if an instance configuration omits the security.idmap.isolated key. An attacker can exploit this flaw by creating or updating an instance without explicitly setting security.idmap.isolated, bypassing the target project's security constraints.

Affected configurations

• canonical lxd (>= 4.0.0 < 4.0.12) • canonical lxd (>= 5.0.0 < 5.0.8) • canonical lxd (>= 5.1 < 5.21.6) • canonical lxd (>= 6.0 < 6.10)

Related

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References