CVE-2026-62420

CVE-2026-62420 is an authorization bypass (CWE-863) in Canonical's LXD container and virtual machine manager that allows an authenticated attacker to evade target-project security restrictions during cross-project instance migrations. It is triggered when an instance is moved across projects to a different cluster member via POST /1.0/instances/{name} with migration: true along with project and target parameters; because the request reaches the destination node as an internal cluster notification, that node skips all project restriction checks. An attacker who can invoke this migration path can introduce instance configurations that the destination project's restrictions would normally disallow, undermining multi-tenant isolation, and the critical 9.9 CVSS score reflects high potential impact across confidentiality, integrity, and availability with scope change. Exposure is limited to operators running clustered LXD deployments with multiple projects, particularly where untrusted authenticated users can create instances in restricted projects; single-node or single-project setups are not exposed to this path. No in-the-wild exploitation is confirmed (not in CISA KEV, EPSS ~0.3%), but Canonical has published a public security advisory (GHSA-v9wr-9r7q-fh4g) documenting the flaw.

What to do: Upgrade LXD to the patched release identified in Canonical's advisory GHSA-v9wr-9r7q-fh4g (version numbers are not included in the source data). Until patched, restrict which authenticated users may initiate cross-project migrations, and review instances in restricted projects for unexpected configurations introduced via cross-project moves, checking logs for POST /1.0/instances/{name} requests using migration: true with project and target parameters. Cluster operators who do not use restricted projects or cross-project migration are not exposed to this specific attack path.