CVE-2026-63297: canonical lxd

Vulnerability summary

CVE-2026-63297 is a critical (CVSS 9.9) vulnerability in canonical lxd. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 12-08-2026
   PublishedVulnerability first disclosed.
2. 13-08-2026
   Last modifiedVulnerability information updated.

Description

An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction checks before configuration merging is complete, creating a time-of-check to time-of-use (TOCTOU) condition. An attacker can exploit this flaw to copy instances with disallowed high-privilege configurations into restricted projects, bypassing security controls.

• CWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionThe product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.