CVE-2026-63300

CVE-2026-63300 is a missing-authorization flaw (CWE-862) in the instancePostMigration function of lxd/instance_post.go in Canonical LXD: when an instance is moved between projects, LXD fails to validate the instance's configuration against the target project's enforced restrictions. An authenticated attacker who holds can_create_instances permission on a restricted project can create a disallowed or high-privilege instance in an unrestricted project and then move it into the restricted project. The attacker thereby bypasses project-level controls such as restricted.containers.lowlevel, restricted.devices.*, and restricted.networks.access, gaining instances with capabilities that the restricted project was configured to prohibit. Only LXD deployments using multi-project configurations with restricted projects and delegated (non-admin) users are practically affected. Exploitation has not been reported in the wild (EPSS 0.3%, not in CISA KEV), but a public advisory (GHSA-5g5r-wh97-qcq2) and fix pull request are available.

What to do: Upgrade LXD to the patched release identified in Canonical's security advisory GHSA-5g5r-wh97-qcq2 (fix tracked in pull request #18605); do not rely on version numbers not listed here. Until patched, audit instances that have been moved into restricted projects for configurations that violate restricted.* limits (e.g., low-level container options, device types, network access) and consider temporarily revoking cross-project move permissions or can_create_instances grants from delegated users. Administrators should also verify which users hold rights in both unrestricted and restricted projects, since that dual access is the key to triggering the bypass.