CVE-2026-63295

Name of the Vulnerable Software and Affected Versions LXD (affected versions not specified)

Description An authorization bypass allows an authenticated attacker to circumvent project-level container isolation restrictions. The issue occurs when a project is configured to enforce restricted container privileges, such as restricted.containers.privilege=isolated, but LXD fails to enforce this requirement if the instance configuration omits the security.idmap.isolated key. An attacker can bypass security constraints by creating or updating an instance without explicitly setting the security.idmap.isolated variable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.