Log in Start free

Vulnerability · Published Aug 12, 2026 · Assigned by canonical

CVE-2026-63295Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated`

Medium 4.3

In plain English

A medium-severity incorrect authorization in LXD from Canonical. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 71.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges (such as enforcing restricted.containers.privilege=isolated), LXD fails to enforce the requirement if an instance configuration omits the security.idmap.isolated key. An attacker can exploit this flaw by creating or updating an instance without explicitly setting security.idmap.isolated, bypassing the target project's security constraints.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12lxdno fix listedDEBIAN-CVE-2026-63295
Debian:13lxdno fix listedDEBIAN-CVE-2026-63295

Affected products (as reported)

VendorProductVersions
Canonical LXD 4.0.0 – before 4.0.125.0.0 – before 5.0.85.21.0 – before 5.21.66.0 – before 6.10

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References