CVE-2026-62420

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-62420", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2026-07-14T08:57:47.667Z", "datePublished": "2026-08-12T19:12:28.097Z", "dateUpdated": "2026-08-12T19:27:44.371Z"}, "containers": {"cna": {"title": "Cross-project cluster migration bypasses project restrictions via cluster notification flag", "descriptions": [{"lang": "en", "value": "An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/{name} with migration: true, project: <target>, and target: <member>, the destination node skips all project restriction checks because the request arrives as an internal cluster notification. An attacker can exploit this to introduce disallowed instance configurations into a restricted project."}], "affected": [{"vendor": "Canonical", "product": "LXD", "packageName": "LXD", "platforms": ["Linux"], "repo": "https://github.com/canonical/lxd", "defaultStatus": "unaffected", "versions": [{"version": "5.0.0", "status": "affected", "versionType": "semver", "lessThan": "5.0.8"}, {"version": "5.21.0", "status": "affected", "versionType": "semver", "lessThan": "5.21.6"}, {"version": "6.0", "status": "affected", "versionType": "semver", "lessThan": "6.10"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-863 Incorrect Authorization", "cweId": "CWE-863", "type": "CWE"}]}], "references": [{"url": "https://github.com/canonical/lxd/security/advisories/GHSA-v9wr-9r7q-fh4g", "tags": ["vdb-entry", "vendor-advisory"]}, {"url": "https://github.com/canonical/lxd/pull/18651", "tags": ["patch"]}, {"url": "https://github.com/canonical/lxd/pull/18605", "tags": ["patch"]}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}, {"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "Privilege Abuse"}]}, {"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "Privilege Escalation"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL"}}], "source": {"discovery": "EXTERNAL"}, "solutions": [{"lang": "en", "value": "Upgrade to LXD version 5.0.8 or later, 5.21.6 or later, or 6.10 or later."}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-08-12T19:12:28.097Z"}}, "adp": [{"references": [{"url": "https://github.com/canonical/lxd/security/advisories/GHSA-v9wr-9r7q-fh4g", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-12T19:26:54.388067Z", "id": "CVE-2026-62420", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T19:27:44.371Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-62420", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2026-07-14T08:57:47.667Z", "datePublished": "2026-08-12T19:12:28.097Z", "dateUpdated": "2026-08-12T19:27:44.371Z"}, "containers": {"cna": {"title": "Cross-project cluster migration bypasses project restrictions via cluster notification flag", "descriptions": [{"lang": "en", "value": "An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/{name} with migration: true, project: <target>, and target: <member>, the destination node skips all project restriction checks because the request arrives as an internal cluster notification. An attacker can exploit this to introduce disallowed instance configurations into a restricted project."}], "affected": [{"vendor": "Canonical", "product": "LXD", "packageName": "LXD", "platforms": ["Linux"], "repo": "https://github.com/canonical/lxd", "defaultStatus": "unaffected", "versions": [{"version": "5.0.0", "status": "affected", "versionType": "semver", "lessThan": "5.0.8"}, {"version": "5.21.0", "status": "affected", "versionType": "semver", "lessThan": "5.21.6"}, {"version": "6.0", "status": "affected", "versionType": "semver", "lessThan": "6.10"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-863 Incorrect Authorization", "cweId": "CWE-863", "type": "CWE"}]}], "references": [{"url": "https://github.com/canonical/lxd/security/advisories/GHSA-v9wr-9r7q-fh4g", "tags": ["vdb-entry", "vendor-advisory"]}, {"url": "https://github.com/canonical/lxd/pull/18651", "tags": ["patch"]}, {"url": "https://github.com/canonical/lxd/pull/18605", "tags": ["patch"]}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}, {"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "Privilege Abuse"}]}, {"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "Privilege Escalation"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL"}}], "source": {"discovery": "EXTERNAL"}, "solutions": [{"lang": "en", "value": "Upgrade to LXD version 5.0.8 or later, 5.21.6 or later, or 6.10 or later."}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-08-12T19:12:28.097Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-62420", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-12T19:26:54.388067Z"}}}], "references": [{"url": "https://github.com/canonical/lxd/security/advisories/GHSA-v9wr-9r7q-fh4g", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T19:27:36.844Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "LXD", "platforms": ["Linux"], "product": "LXD", "repo": "https://github.com/canonical/lxd", "vendor": "Canonical", "versions": [{"lessThan": "5.0.8", "status": "affected", "version": "5.0.0", "versionType": "semver"}, {"lessThan": "5.21.6", "status": "affected", "version": "5.21.0", "versionType": "semver"}, {"lessThan": "6.10", "status": "affected", "version": "6.0", "versionType": "semver"}]}], "source": "security@ubuntu.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "matchCriteriaId": "59D070D6-84D2-400E-8260-EA52E5C60D37", "versionEndExcluding": "5.0.8", "versionStartIncluding": "5.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "matchCriteriaId": "575036D1-2B55-4043-B94A-1584E3F2DA37", "versionEndExcluding": "5.21.6", "versionStartIncluding": "5.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "matchCriteriaId": "374F5622-1D8F-4EF9-97E6-736C8220623B", "versionEndExcluding": "6.10", "versionStartIncluding": "6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/{name} with migration: true, project: <target>, and target: <member>, the destination node skips all project restriction checks because the request arrives as an internal cluster notification. An attacker can exploit this to introduce disallowed instance configurations into a restricted project."}, {"lang": "es", "value": "Una vulnerabilidad de omisi\u00f3n de autorizaci\u00f3n en LXD permite a un atacante autenticado omitir las restricciones de seguridad del proyecto de destino durante las migraciones de instancias entre proyectos. Al mover una instancia entre proyectos a un miembro diferente del cl\u00faster a trav\u00e9s de POST /1.0/instances/{name} con migration: true, project: [target] y target: [member], el nodo de destino omite todas las comprobaciones de restricci\u00f3n del proyecto porque la solicitud llega como una notificaci\u00f3n interna del cl\u00faster. Un atacante puede explotar esto para introducir configuraciones de instancia no permitidas en un proyecto restringido."}], "id": "CVE-2026-62420", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "security@ubuntu.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62420", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-12T19:26:54.388067Z", "version": "2.0.3"}}]}, "published": "2026-08-12T20:17:46.897", "references": [{"source": "security@ubuntu.com", "tags": ["Patch"], "url": "https://github.com/canonical/lxd/pull/18605"}, {"source": "security@ubuntu.com", "tags": ["Patch"], "url": "https://github.com/canonical/lxd/pull/18651"}, {"source": "security@ubuntu.com", "tags": ["Vendor Advisory", "Exploit", "Mitigation"], "url": "https://github.com/canonical/lxd/security/advisories/GHSA-v9wr-9r7q-fh4g"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Vendor Advisory", "Exploit", "Mitigation"], "url": "https://github.com/canonical/lxd/security/advisories/GHSA-v9wr-9r7q-fh4g"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security@ubuntu.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.0.8)"}}, {"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[5.21.0,5.21.6)"}}, {"platform": ["linux"], "status": "affected", "versions": {"scheme": "generic", "value": "[6.0,6.10)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "LXD", "source": "cna", "vendor": "Canonical"}, "product": "lxd", "vendor": "canonical"}], "created": "2026-08-12T21:00:03.824660+00:00", "updated": "2026-08-12T23:30:10.475884+00:00", "vendors": ["canonical", "canonical$PRODUCT$lxd"]}