CVE-2026-63295: canonical lxd Incorrect Authorization

Vulnerability summary

CVE-2026-63295 is a medium (CVSS 4.3) Incorrect Authorization vulnerability in canonical lxd. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 26.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 12-08-2026
   PublishedVulnerability first disclosed.
2. 13-08-2026
   Last modifiedVulnerability information updated.

Description

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges (such as enforcing restricted.containers.privilege=isolated), LXD fails to enforce the requirement if an instance configuration omits the security.idmap.isolated key. An attacker can exploit this flaw by creating or updating an instance without explicitly setting security.idmap.isolated, bypassing the target project's security constraints.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.