CVE-2026-63299

Name of the Vulnerable Software and Affected Versions LXD (affected versions not specified)

Description An authorization bypass allows an authenticated user to exceed project-level disk and volume limits. This occurs because two code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove() function omits the limits.AllowVolumeCreation check when moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil (Config == nil). An attacker can use these flaws to allocate storage resources beyond the administrative limits set for a project.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.