CVE-2026-62420 Cross-project cluster migration bypasses project restrictions via cluster notification flag
Authenticated attackers can bypass project restrictions during cross-project instance migrations in LXD, introducing disallowed configurations into restricted projects.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-62420?
CVE-2026-62420 is a critical missing authorization vulnerability in Canonical LXD, published on 12 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/{name} with migration: true, project: <target>, and target: <member>, the destination node skips all project restriction checks because the request arrives as an internal cluster notification. An attacker can exploit this to introduce disallowed instance configurations into a restricted project.
Weakness: CWE-863
Which versions are affected by CVE-2026-62420?
It affects 1 product.
Products include Canonical Lxd.
How do I fix CVE-2026-62420?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-62420 being exploited?
There is no known exploitation of CVE-2026-62420 in the wild and no public exploit code.
Other vulnerabilities in Canonical LXD
- CVE-2026-66897 Instance template path traversal allows arbitrary host file write as root
- CVE-2026-63293 Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root
- CVE-2026-63294 Root RCE via image backup.yaml symlink
- CVE-2026-63296 Project restriction bypass via instance migration config override
- CVE-2026-63297 Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge
Sources
Also known as DEBIAN-CVE-2026-62420, GHSA-v9wr-9r7q-fh4g, UBUNTU-CVE-2026-62420.