CVE-2026-63297: LXD Authorization Bypass Vulnerability

CVE-2026-63297 Overview

CVE-2026-63297 is an authorization bypass vulnerability in LXD, the system container and virtual machine manager maintained by Canonical. The flaw resides in the cross-project instance copy workflow, where LXD evaluates project restriction checks before configuration merging completes. This ordering creates a time-of-check to time-of-use (TOCTOU) window classified under [CWE-367]. An authenticated attacker with permissions in a source project can copy an instance carrying disallowed high-privilege configuration keys into a restricted target project. The result is a bypass of the security controls that restricted projects are designed to enforce.

Critical Impact
An authenticated attacker can smuggle privileged instance configurations into restricted LXD projects, breaking project isolation and gaining elevated capabilities on the host.

Affected Products

Canonical LXD (system container and VM manager)
LXD deployments using project-based multi-tenancy with restrictions enabled
Environments permitting cross-project instance copy operations

Discovery Timeline

2026-08-12 - CVE-2026-63297 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-63297

Vulnerability Analysis

LXD supports multi-tenant deployments through projects, which can be marked as restricted to prevent instances from using high-privilege configuration keys such as security.privileged, host device passthrough, or raw LXC options. When a user copies an instance across projects, LXD must validate that the resulting instance configuration complies with the target project's restrictions.

The vulnerability stems from the order of operations in the copy handler. LXD performs restriction validation against the instance state observed before configuration merging finishes. Configuration keys inherited from profiles, expanded devices, or source-instance overrides are applied after the check passes. The final materialized instance in the target project therefore carries configuration that the restriction policy should have rejected.

Root Cause

The root cause is a TOCTOU race between the authorization decision and the configuration merge step. The check consumes a partial view of the instance definition, while the use step assembles the complete configuration that the daemon persists and runs. Because the checked state and the used state differ, the policy engine cannot enforce project restrictions reliably.

Attack Vector

Exploitation requires an authenticated LXD client with permission to initiate an instance copy from a source project into a target restricted project. The attacker crafts a source instance whose expanded configuration includes disallowed keys, then issues a cross-project copy request. LXD approves the operation, merges the configuration in the target project, and instantiates the workload with elevated privileges. From there, the attacker can leverage privileged containers, device passthrough, or raw LXC directives to escalate on the host and break out of tenant isolation.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-v989-qw7w-xvg4 for vendor technical detail.

Detection Methods for CVE-2026-63297

Indicators of Compromise

Instances in restricted projects containing configuration keys such as security.privileged=true, security.nesting, raw.lxc, or raw.apparmor that project policy should forbid.
Audit log entries in /var/log/lxd/lxd.log showing successful POST /1.0/instances?project= copy operations targeting restricted projects.
Unexpected host device entries (type: unix-char, type: disk with host source paths) attached to instances in tenant projects.

Detection Strategies

Enumerate every instance across restricted projects with lxc config show and compare expanded configuration against the project's restricted.* policy.
Monitor the LXD REST API for cross-project copy requests, correlating source and target project restriction posture.
Alert on any container starting with elevated privileges inside a project marked restricted=true.

Monitoring Recommendations

Forward LXD daemon logs and audit events into a centralized SIEM for retention and correlation with host-level activity.
Track process and namespace anomalies on LXD hosts, particularly container processes running with CAP_SYS_ADMIN or accessing host devices.
Baseline the set of privileged instances per project and alert on deviations.

How to Mitigate CVE-2026-63297

Immediate Actions Required

Upgrade LXD to the patched release identified in the Canonical advisory as soon as it is available in your distribution channel.
Audit every restricted project for instances whose merged configuration violates the restriction policy and quarantine any offenders.
Review LXD RBAC assignments and revoke cross-project copy permissions from users who do not require them.

Patch Information

Canonical published the fix and technical description in the GitHub Security Advisory GHSA-v989-qw7w-xvg4. Apply the LXD update through your platform package manager or snap channel and restart the lxd service to load the corrected copy handler.

Workarounds

Disable cross-project instance copy operations by restricting the relevant RBAC entitlements until the patch is deployed.
Enforce restricted project policy through admission review of new instances, rejecting any instance whose expanded configuration contains disallowed keys.
Isolate multi-tenant LXD hosts on dedicated infrastructure to limit blast radius if project boundaries are bypassed.

bash

# Configuration example: enforce and verify restricted project settings
lxc project set <target-project> restricted=true
lxc project set <target-project> restricted.containers.privileged=block
lxc project set <target-project> restricted.containers.nesting=block
lxc project set <target-project> restricted.devices.unix-char=block
lxc project set <target-project> restricted.devices.disk=block

# Audit expanded configuration for instances in a restricted project
for inst in $(lxc list project=<target-project> -c n --format csv); do
  lxc config show "$inst" --expanded --project <target-project>
done