Canonical LXD up to 5.0.7/5.21.5/6.9 Volume Operations storagePoolVolumeTypePostMove authorization

Summaryinfo

A vulnerability was found in Canonical LXD up to 5.0.7/5.21.5/6.9. It has been declared as problematic. The affected element is the function storagePoolVolumeTypePostMove of the component Volume Operations. Executing a manipulation can lead to authorization. The identification of this vulnerability is CVE-2026-63299. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability has been found in Canonical LXD up to 5.0.7/5.21.5/6.9 and classified as problematic. This vulnerability affects the function storagePoolVolumeTypePostMove of the component Volume Operations. The manipulation with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. As an impact it is known to affect integrity, and availability. CVE summarizes:

An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil (Config == nil). An attacker can exploit these flaws to allocate storage resources that exceed the administrative limits configured for a project.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-63299 since 07/16/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available.

Upgrading to version 5.0.8, 5.21.6 or 6.10 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Canonical

Name

• LXD

Version

• 5.0.0
• 5.0.1
• 5.0.2
• 5.0.3
• 5.0.4
• 5.0.5
• 5.0.6
• 5.0.7
• 5.21.0
• 5.21.1
• 5.21.2
• 5.21.3
• 5.21.4
• 5.21.5
• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6
• 6.7
• 6.8
• 6.9

License

• open-source

Website

• Product: https://github.com/canonical/lxd/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion