CVE-2026-62420
CriticalCVSS 9.9Summary
An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/{name} with migration: true, project: <target>, and target: <member>, the destination node skips all project restriction checks because the request arrives as an internal cluster notification. An attacker can exploit this to introduce disallowed instance configurations into a restricted project.
Risk Assessment
The risk for the organization is a breach of project isolation in LXD, which can lead to unauthorized configuration changes and potential privilege escalation in the cluster environment.
Recommendation
It is recommended to update LXD to a patched version and review cross-project migration policies. Also monitor migration logs for unusual activity.
Original NVD description (English source)
An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/{name} with migration: true, project: <target>, and target: <member>, the destination node skips all project restriction checks because the request arrives as an internal cluster notification. An attacker can exploit this to introduce disallowed instance configurations into a restricted project.