CVE-2026-62420: LXD Auth Bypass Vulnerability

CVE-2026-62420 Overview

CVE-2026-62420 is an authorization bypass vulnerability in LXD, the system container and virtual machine manager developed by Canonical. The flaw allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations across cluster members. When a migration request arrives at the destination node, LXD treats it as an internal cluster notification and skips project restriction enforcement. An attacker can leverage this behavior to inject disallowed instance configurations into a restricted project, escalating privileges within the LXD cluster.

Critical Impact
An authenticated user can smuggle prohibited instance configurations into restricted projects, breaking multi-tenant isolation across LXD clusters.

Affected Products

Canonical LXD (clustered deployments)
LXD versions prior to the patches in Pull Request #18605 and #18651
Multi-tenant LXD clusters using project restrictions

Discovery Timeline

2026-08-12 - CVE-2026-62420 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-62420

Vulnerability Analysis

LXD enforces per-project restrictions to constrain what instance configurations tenants can create, including limits on privileged containers, device passthrough, and kernel capabilities. The vulnerability breaks this enforcement model when instances move between projects across cluster members.

The attack uses POST /1.0/instances/{name} with migration: true, project: <target>, and target: <member> parameters. The origin node forwards the migration to the destination cluster member as an internal cluster notification. The destination node interprets the request as trusted internal traffic and skips the project restriction checks that would normally reject non-compliant configurations. This flaw is classified as [CWE-863: Incorrect Authorization].

Root Cause

The root cause is inconsistent authorization enforcement between externally-originated API requests and internal cluster-forwarded requests. LXD assumes that cluster-internal notifications have already been validated by the receiving cluster peer. Project restriction validation only runs on the initial request handler, not on the destination node that ultimately materializes the instance.

Attack Vector

An authenticated user with permission to create and migrate instances in a source project targets a restricted destination project on a different cluster member. The migration request bypasses the destination project's restrictions and lands the instance with a configuration the target project would normally reject. See the GitHub Security Advisory GHSA-v9wr-9r7q-fh4g for the full technical description.

// No verified proof-of-concept code is publicly available.
// Refer to the LXD security advisory and patches for technical details:
// - https://github.com/canonical/lxd/pull/18605
// - https://github.com/canonical/lxd/pull/18651

Detection Methods for CVE-2026-62420

Indicators of Compromise

Instances in restricted projects with configurations that violate the project's restricted.* policy (for example, privileged containers where prohibited).
LXD API audit entries for POST /1.0/instances/{name} requests containing both migration: true and a project parameter that differs from the source project.
Cluster-internal notification traffic between members that produces instances whose configuration would be rejected by a direct API call.

Detection Strategies

Review LXD daemon logs for cross-project migration requests, correlating source project, target project, and target cluster member.
Periodically diff every instance configuration in restricted projects against the project's restricted.* allowlist to detect drift.
Alert on any successful instance creation in a restricted project that includes privileged mode, host device passthrough, or additional Linux capabilities.

Monitoring Recommendations

Ingest LXD audit and daemon logs into a centralized logging platform and retain them for post-incident review.
Monitor the LXD REST API endpoint /1.0/instances/{name} for POST requests with the migration flag combined with a project switch.
Track newly created or migrated instances in production clusters and alert on configuration attributes disallowed by project policy.

How to Mitigate CVE-2026-62420

Immediate Actions Required

Upgrade LXD to a fixed release that includes the changes from LXD Pull Request #18605 and LXD Pull Request #18651.
Audit all instances in restricted projects for configurations that violate current project restrictions and remediate or remove offending instances.
Restrict cross-project migration permissions to trusted administrators until patches are applied cluster-wide.

Patch Information

Canonical addressed the flaw with pull requests #18605 and #18651. The fixes enforce project restriction checks on the destination cluster member during migration, closing the gap where internal cluster notifications previously bypassed validation. Full details are published in the GitHub Security Advisory GHSA-v9wr-9r7q-fh4g.

Workarounds

Disable cross-project instance migration for non-administrative users by tightening LXD RBAC role assignments.
Remove the ability to target restricted projects as migration destinations for standard tenants until the cluster is fully patched.
Isolate sensitive tenants onto dedicated LXD clusters so that cross-project migrations cannot reach them.

bash

# Verify installed LXD version and upgrade on Ubuntu
snap info lxd
sudo snap refresh lxd

# Review project restrictions and confirm enforcement
lxc project show <restricted-project>
lxc list --project <restricted-project> --format csv -c ns,c