CVE-2026-63297

Name of the Vulnerable Software and Affected Versions LXD (affected versions not specified)

Description An authorization bypass exists due to a timing flaw during configuration merging. This creates a time-of-check to time-of-use (TOCTOU) condition—a race condition where a system checks a condition and then uses the result, but the condition changes between the check and the use. An authenticated attacker can exploit this during cross-project instance copies to bypass target project restrictions, allowing the copying of instances with disallowed high-privilege configurations into restricted projects.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.