CVE-2026-63295: falha de média gravidade em Canonical LXD
Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated`
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.3%
An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges (such as enforcing restricted.containers.privilege=isolated), LXD fails to enforce the requirement if an instance configuration omits the security.idmap.isolated key. An attacker can exploit this flaw by creating or updating an instance without explicitly setting security.idmap.isolated, bypassing the target project's security constraints.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Produtos afetados
Canonical · LXDCVEs relacionadas — Canonical LXD
No mesmo produto, das mais perigosas para as menos.
CVE-2026-63294CRITICALRoot RCE via image backup.yaml symlinkEPSS 0.9%CVE-2026-66897CRITICALInstance template path traversal allows arbitrary host file write as rootEPSS 0.7%CVE-2026-63298HIGHLXD arbitrary lxc.conf directive injection via NVIDIA instance configurationEPSS 0.7%CVE-2026-9640HIGHLXD Snapshot Import Privilege Escalation VulnerabilityEPSS 0.6%CVE-2025-54293HIGHPath Traversal in LXD Instance Log File RetrievalEPSS 0.6%CVE-2026-66898CRITICALPath traversal via unvalidated instance name in backup tarball restore enables root file write / RCEEPSS 0.6%