CVE-2026-63299 in LXD
Summary
by MITRE • 08/12/2026
An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil (Config == nil). An attacker can exploit these flaws to allocate storage resources that exceed the administrative limits configured for a project.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/12/2026
This vulnerability represents a critical authorization bypass flaw in LXD container management software that undermines the security model designed to protect project resource boundaries. The issue stems from insufficient validation mechanisms within the storage management subsystem where authenticated users can manipulate volume operations to circumvent administrative controls. The vulnerability affects the core project isolation features that are fundamental to multi-tenant container environments, potentially allowing unauthorized resource consumption that could lead to denial of service conditions and resource exhaustion across project boundaries.
The technical implementation of this flaw occurs through two distinct code paths within LXD's storage management logic. The first vulnerability exists in the storagePoolVolumeTypePostMove function which fails to perform the mandatory limits.AllowVolumeCreation check before executing cross-project volume movement operations. This omission allows authenticated users to transfer volumes between projects without verifying that such operations comply with project-specific resource allocation policies. The second vulnerability manifests during volume snapshot restore operations where the system skips the AllowVolumeUpdate check when processing configuration data that is nil or undefined, effectively bypassing security controls that should validate any modifications to volume properties.
The operational impact of this vulnerability extends beyond simple privilege escalation into broader resource management concerns that affect system stability and security posture. An attacker with authenticated access can exploit these flaws to consume storage resources beyond the configured project limits, potentially leading to resource starvation for other legitimate users within the same environment. This capability undermines the fundamental security principle of least privilege and allows for unauthorized consumption of compute resources that organizations have explicitly restricted through their project configurations. The vulnerability creates a persistent risk where malicious actors can gradually accumulate resources that exceed administrative allocations without detection.
The implications of this authorization bypass align with common weakness enumerations such as CWE-693 which addresses protection mechanism failures, and relates to ATT&CK technique T1078.101 for valid accounts and privilege escalation through unauthorized resource consumption. Organizations relying on LXD for container orchestration face significant risk exposure when these vulnerabilities remain unaddressed, particularly in environments where multiple projects or tenants share the same infrastructure. The vulnerability demonstrates a failure in defense-in-depth principles where boundary checks are not consistently enforced across all code paths that manipulate storage resources, creating exploitable gaps in access control mechanisms.
Mitigation strategies should focus on implementing comprehensive access control validation at all storage operation boundaries and ensuring that resource limit checks are consistently applied regardless of operational context. Organizations must update their LXD installations to patched versions that address these specific code path validations, while also implementing monitoring controls to detect unauthorized volume movement operations. Additional protective measures include strengthening project-level access controls through more granular permission models and establishing automated alerting for resource consumption patterns that exceed configured limits. Regular security assessments should verify that all storage management functions properly enforce resource boundaries and that no similar authorization bypass opportunities exist within the system architecture.
The vulnerability highlights the importance of thorough code review processes focusing on security boundary checks, particularly in systems where resource isolation is critical for maintaining security policies. It demonstrates how seemingly minor implementation oversights can create significant security weaknesses that compromise fundamental architectural assumptions about resource management and access control. Organizations should consider implementing additional layers of validation including runtime monitoring and automated compliance checking to detect and prevent exploitation attempts against similar authorization bypass vulnerabilities in their containerized environments.