CVE-2026-63299 Storage volume cross-project move and snapshot restore bypass project disk limits

High 8.5 Published 12 Aug 2026 Updated 12 Aug 2026

Authenticated users can bypass project disk limits during volume moves or snapshot restores, potentially exhausting storage resources.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-63299?

CVE-2026-63299 is a high-severity missing authorization vulnerability in Canonical LXD, published on 12 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil (Config == nil). An attacker can exploit these flaws to allocate storage resources that exceed the administrative limits configured for a project.

Weakness: CWE-770

Which versions are affected by CVE-2026-63299?

It affects 1 product.

Products include Canonical Lxd.

How do I fix CVE-2026-63299?

Apply the vendor's patch.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-63299 being exploited?

There is no known exploitation of CVE-2026-63299 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-63299, GHSA-5h78-p252-989h, UBUNTU-CVE-2026-63299.