CVE-2026-63299

CVE-2026-63299 is an authorization bypass in Canonical's LXD container and virtual machine manager that allows an authenticated, low-privileged user to allocate storage beyond the disk and volume limits configured for their project. The flaw exists in two code paths: the storagePoolVolumeTypePostMove function moves a volume across projects without performing the limits.AllowVolumeCreation check, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil (Config == nil). By triggering a cross-project volume move or a snapshot restore, an attacker with valid credentials on a multi-project LXD instance can consume storage exceeding the project's administrative quota, potentially exhausting host or shared storage pool resources (rated critical at CVSS 9.9). Deployments are affected where untrusted authenticated users operate within projects that have resource limits enforced; the affected and fixed version ranges are not specified in the available data and are documented in Canonical's advisory GHSA-5h78-p252-989h. Exploitation has not been confirmed in the wild: the flaw is not in CISA's KEV catalog, EPSS estimates only a 0.3% probability of exploitation within 30 days, and the sole public reference is the vendor advisory.

What to do: Upgrade LXD to the patched release identified in Canonical's security advisory GHSA-5h78-p252-989h and verify your installed version against the advisory's affected ranges. Until patched, restrict LXD access to trusted users and audit project volumes and snapshots for allocations exceeding configured project limits, prioritizing multi-project deployments that expose the LXD API to other users.