CVE-2026-63299highCWE-770

CVE-2026-63299: fallo de gravedad alta en Canonical LXD

Storage volume cross-project move and snapshot restore bypass project disk limits

Publicada el

Seguir esta CVE+ Monitorear LXD+ Monitorear lxd

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.5epss 0.6%
An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil (Config == nil). An attacker can exploit these flaws to allocate storage resources that exceed the administrative limits configured for a project.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Productos afectados
Canonical · LXD
CVEs relacionadas — Canonical LXD

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-63294CRITICALRoot RCE via image backup.yaml symlinkEPSS 0.9%CVE-2026-66897CRITICALInstance template path traversal allows arbitrary host file write as rootEPSS 0.7%CVE-2026-63298HIGHLXD arbitrary lxc.conf directive injection via NVIDIA instance configurationEPSS 0.7%CVE-2026-9640HIGHLXD Snapshot Import Privilege Escalation VulnerabilityEPSS 0.6%CVE-2025-54293HIGHPath Traversal in LXD Instance Log File RetrievalEPSS 0.6%CVE-2026-66898CRITICALPath traversal via unvalidated instance name in backup tarball restore enables root file write / RCEEPSS 0.6%