CVE-2026-63297

CVE-2026-63297 is an authorization bypass in Canonical's LXD container/systems manager caused by a time-of-check to time-of-use (TOCTOU) race during configuration merging. When an authenticated user copies an instance into a target project, LXD performs its restriction checks before the configuration merge finishes, allowing the attacker to slip past those checks. As a result, the attacker can copy an instance carrying disallowed high-privilege configuration (e.g., privileged settings) into a project where such configuration is supposed to be forbidden, gaining elevated capabilities within that restricted project and potentially weakening project isolation. Any LXD deployment that uses projects with restrictions and permits cross-project instance copies is affected; exploitability requires an authenticated low-privilege LXD user and no user interaction. Exploitation has not been observed in the wild (not in CISA KEV, EPSS ~0.2%), but a public advisory reference (GHSA-v989-qw7w-xvg4) exists.

What to do: Upgrade LXD to the fixed release identified in Canonical's security advisory (GHSA-v989-qw7w-xvg4), as no fixed version is listed in the data provided. Until patched, restrict which authenticated users may perform cross-project instance copies and consider temporarily disallowing copies into restricted projects, then audit restricted projects for instances containing disallowed high-privilege configuration. Minimize network exposure of the LXD API (port 8443) since the flaw is remotely exploitable by any authenticated user.