CVE-2026-63297 in LXD
Summary
by MITRE • 08/12/2026
An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction checks before configuration merging is complete, creating a time-of-check to time-of-use (TOCTOU) condition. An attacker can exploit this flaw to copy instances with disallowed high-privilege configurations into restricted projects, bypassing security controls.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability under discussion represents a critical authorization bypass flaw in LXD container management software that stems from a fundamental timing issue during configuration processing. This weakness exists within the cross-project instance copying functionality where the system performs restriction checks at an inappropriate moment in the operational sequence. The flaw creates a temporal window between when access controls are evaluated and when configuration merging is completed, allowing malicious actors to exploit this gap for unauthorized privilege escalation.
This vulnerability manifests as a classic time-of-check to time-of-use security issue that falls under CWE-367, where the system's state evaluation occurs before the final configuration processing is complete. The timing discrepancy enables an authenticated attacker to manipulate the copy operation sequence and inject configurations that would normally be restricted in target projects. When LXD copies an instance to a different project, it initially validates access permissions against the target project restrictions before completing the configuration merging process, creating a window where malicious configuration elements can be introduced.
The operational impact of this vulnerability extends beyond simple privilege escalation as it allows attackers to bypass project-level security boundaries that are fundamental to container isolation. An authenticated user can leverage this flaw to inject high-privilege configurations into restricted projects, effectively undermining the multi-tenant security model that LXD implements. This bypass enables attackers to gain elevated capabilities within target projects, potentially leading to unauthorized access to sensitive data, system compromise, or further lateral movement within the infrastructure.
The technical exploitation of this vulnerability requires an understanding of LXD's internal configuration handling mechanisms and the ability to time operations precisely during the copy process. Attackers must first authenticate to the system with sufficient privileges to initiate cross-project copies, then carefully orchestrate their actions to exploit the temporal gap between permission validation and configuration merging completion. This timing-based attack vector makes the vulnerability particularly challenging to detect through standard monitoring systems as it occurs within legitimate operational sequences.
Organizations utilizing LXD should implement immediate mitigations including updating to patched versions that address the timing condition in configuration processing, implementing additional validation checks during cross-project operations, and establishing stricter monitoring of instance copy activities. The vulnerability demonstrates the importance of proper synchronization in security-critical operations and highlights the need for comprehensive temporal consistency checks in distributed systems. From an ATT&CK perspective, this vulnerability maps to privilege escalation techniques and could enable lateral movement within containerized environments through the exploitation of configuration injection flaws that bypass project isolation controls.