CVE-2026-63300

Name of the Vulnerable Software and Affected Versions LXD (affected versions not specified)

Description An improper validation issue in the instancePostMigration() function within lxd/instance post.go allows an authenticated attacker with can create instances permissions on a restricted project to bypass project-level security restrictions. During instance migration between projects, the system fails to validate the instance configuration against the target project's enforced restrictions, including restricted.containers.lowlevel, restricted.devices.*, and restricted.networks.access. This can be exploited by creating a high-privilege or disallowed instance in an unrestricted project and moving it into a restricted one, potentially leading to host command execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.