CVE-2026-62420 in LXD
Summary
by MITRE • 08/12/2026
An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/{name} with migration: true, project: <target>, and target: <member>, the destination node skips all project restriction checks because the request arrives as an internal cluster notification. An attacker can exploit this to introduce disallowed instance configurations into a restricted project.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
This authorization bypass vulnerability in LXD represents a critical security flaw that undermines the fundamental project isolation mechanisms designed to protect sensitive environments. The vulnerability stems from improper handling of cross-project instance migrations within the LXD cluster architecture, where internal cluster notifications are processed without adequate validation of project boundaries. When an authenticated attacker sends a migration request using the POST /1.0/instances/{name} endpoint with specific parameters including migration: true, project: <target>, and target: <member>, the system fails to enforce project-specific access controls during the migration process. This flaw exists because the destination node treats incoming migration requests as internal cluster communications rather than external user requests, thereby bypassing all standard project restriction checks that would normally prevent unauthorized access to restricted project resources.
The technical implementation of this vulnerability exploits the trust relationship between cluster members by leveraging the internal notification mechanism that should only be used for legitimate cluster operations. The flaw specifically affects the migration endpoint where the system accepts project parameters in the request payload without validating whether the requesting user has appropriate permissions to move instances into the target project. This creates a path for privilege escalation where an attacker can inject instance configurations that would normally be prohibited in restricted projects, effectively breaking down the security isolation that projects are meant to provide.
The operational impact of this vulnerability extends beyond simple unauthorized access to potentially enable more sophisticated attacks within compromised environments. An attacker who can successfully exploit this bypass could introduce malicious instance configurations into restricted projects, potentially leading to data exfiltration, system compromise, or further lateral movement within the cluster. The vulnerability particularly affects multi-tenant LXD deployments where different projects represent isolated environments for different users or applications, making it a significant concern for cloud infrastructure providers and organizations relying on project-based security controls. This authorization bypass can be exploited by attackers who already have authentication credentials but lack direct permissions to access restricted projects.
Mitigation strategies should focus on implementing strict validation of migration requests regardless of their source within the cluster, ensuring that all project restriction checks are enforced during cross-project operations. Organizations should consider updating their LXD configurations to require explicit permission verification for all migration activities and implement additional monitoring controls around instance migration endpoints. The vulnerability aligns with CWE-284 Access Control Issues and can be categorized under ATT&CK technique T1078 Valid Accounts, where attackers leverage legitimate credentials to bypass security controls. Security teams should also consider implementing network segmentation controls that limit direct cluster communication between nodes when possible, as well as regular auditing of migration activities to detect unauthorized attempts to exploit this vulnerability. The fix requires modifications to the internal cluster notification handling logic to ensure that all requests processed through the migration endpoint undergo proper authorization checks regardless of their source within the LXD cluster infrastructure.