CVE-2026-62420

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/{name} with migration: true, project: <target>, and target: <member>, the destination node skips all project restriction checks because the request arrives as an internal cluster notification. An attacker can exploit this to introduce disallowed instance configurations into a restricted project.

Score
CVSS 3.1 9.9 Critical
Status
Analyzed - security@ubuntu.com
Published
2026-08-12
Last modified
2026-10-24
Weaknesses
CWE-863

Affected products

References

 
 
© AVABIS GmbH privacypolicy about