Log in Start free

Vulnerability · Published Aug 12, 2026 · Assigned by canonical

CVE-2026-63299Storage volume cross-project move and snapshot restore bypass project disk limits

High 8.5

In plain English

A high-severity resource allocation without limits in LXD from Canonical. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)8.5High
Exploit odds (30 days)0.6%top 51.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil (Config == nil). An attacker can exploit these flaws to allocate storage resources that exceed the administrative limits configured for a project.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12lxdno fix listedDEBIAN-CVE-2026-63299
Debian:13lxdno fix listedDEBIAN-CVE-2026-63299

Affected products (as reported)

VendorProductVersions
Canonical LXD 5.0.0 – before 5.0.85.21.0 – before 5.21.66.0 – before 6.10

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References