CVE-2026-63296 Project restriction bypass via instance migration config override

What is CVE-2026-63296?

CVE-2026-63296 is a critical authentication bypass vulnerability in Canonical LXD, published on 12 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without validating the new configuration against the target project's enforced restrictions. An attacker can exploit this flaw to move instances with disallowed high-privilege configurations into restricted projects, bypassing security controls.

Weakness: CWE-863

Which versions are affected by CVE-2026-63296?

It affects 1 product.

Products include Canonical Lxd.

How do I fix CVE-2026-63296?

Apply the vendor's patch.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-63296 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-63296 exists.

Other vulnerabilities in Canonical LXD

• CVE-2026-66897 Instance template path traversal allows arbitrary host file write as root Critical 9.9
• CVE-2026-62420 Cross-project cluster migration bypasses project restrictions via cluster notification flag Critical 9.9
• CVE-2026-63293 Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root Critical 9.9
• CVE-2026-63294 Root RCE via image backup.yaml symlink Critical 9.9
• CVE-2026-63297 Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge Critical 9.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-63296, GHSA-gcr9-5q6r-w625, UBUNTU-CVE-2026-63296.