What’s Vulnerable › Vulnerabilities
CVE-2026-63299: Storage volume cross-project move and snapshot restore bypass project disk limits
- Severity: critical (CVSS 9.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.6% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-08-12 · updated 2026-10-24
- Weakness: CWE-770
Description
An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil (Config == nil). An attacker can exploit these flaws to allocate storage resources that exceed the administrative limits configured for a project.
Affected products
- Canonical LXD: from 5.0.0 before 5.0.8; from 5.1 before 5.21.6; from 6.0 before 6.10 — fixed in 5.0.8, 5.21.6, 6.10
How to fix
Upgrade to a fixed version: Canonical LXD 5.0.8, 5.21.6, 6.10. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-63299 or the next vulnerability affects your stack