CVE-2026-63295 Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated`

Medium 4.3 Published 12 Aug 2026 Updated 13 Aug 2026

Authenticated attackers can bypass LXD project isolation restrictions by omitting a specific security configuration key, potentially escalating privileges within the container environment.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-63295?

CVE-2026-63295 is a medium-severity authentication bypass vulnerability in Canonical LXD, published on 12 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges (such as enforcing restricted.containers.privilege=isolated), LXD fails to enforce the requirement if an instance configuration omits the security.idmap.isolated key. An attacker can exploit this flaw by creating or updating an instance without explicitly setting security.idmap.isolated, bypassing the target project's security constraints.

Weakness: CWE-863

Which versions are affected by CVE-2026-63295?

It affects 1 product.

Products include Canonical Lxd.

How do I fix CVE-2026-63295?

Apply the vendor's patch.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-63295 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-63295 exists.

Sources

Also known as DEBIAN-CVE-2026-63295, GHSA-7vp9-3vmp-c5jm, UBUNTU-CVE-2026-63295.