CVE-2026-63300
Cross-project instance move bypasses all project restrictions allowing host command execution
Description
An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker with can_create_instances permissions on a restricted project to bypass project-level security restrictions. When migrating an instance between projects, LXD fails to validate the instance's configuration against the target project's enforced restrictions (such as restricted.containers.lowlevel, restricted.devices.*, and restricted.networks.access). An attacker can exploit this by creating a disallowed or high-privilege instance in an unrestricted project and subsequently moving it into the restricted project.
INFO
Published Date :
Aug. 12, 2026, 7:09 p.m.
Last Modified :
Aug. 12, 2026, 7:09 p.m.
Remotely Exploit :
Yes !
Source :
canonical
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | CRITICAL | cc1ad9ee-3454-478d-9317-d3e869d708bc |
Solution
- Update LXD to the latest version.
- Verify project restrictions are enforced post-migration.
- Review instance migration security controls.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-63300 vulnerability anywhere in the article.