CVE-2026-63295

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63295", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2026-07-16T09:49:29.911Z", "datePublished": "2026-08-12T19:31:32.323Z", "dateUpdated": "2026-08-13T14:24:15.556Z"}, "containers": {"cna": {"title": "Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated`", "descriptions": [{"lang": "en", "value": "An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges (such as enforcing restricted.containers.privilege=isolated), LXD fails to enforce the requirement if an instance configuration omits the security.idmap.isolated key. An attacker can exploit this flaw by creating or updating an instance without explicitly setting security.idmap.isolated, bypassing the target project's security constraints."}], "affected": [{"vendor": "Canonical", "product": "LXD", "packageName": "LXD", "platforms": ["Linux"], "repo": "https://github.com/canonical/lxd", "defaultStatus": "unaffected", "versions": [{"version": "4.0.0", "status": "affected", "versionType": "semver", "lessThan": "4.0.12"}, {"version": "5.0.0", "status": "affected", "versionType": "semver", "lessThan": "5.0.8"}, {"version": "5.21.0", "status": "affected", "versionType": "semver", "lessThan": "5.21.6"}, {"version": "6.0", "status": "affected", "versionType": "semver", "lessThan": "6.10"}]}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-863 Incorrect Authorization", "cweId": "CWE-863"}]}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "Accessing Functionality Not Properly Constrained by ACLs"}]}, {"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "Privilege Abuse"}]}, {"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "Privilege Escalation"}]}], "references": [{"url": "https://github.com/canonical/lxd/security/advisories/GHSA-7vp9-3vmp-c5jm", "tags": ["vdb-entry", "vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "source": {"discovery": "EXTERNAL"}, "solutions": [{"lang": "en", "value": "Upgrade to LXD version 4.0.12 or later, 5.0.8 or later, or 5.12.6 or later, or 6.10 or later."}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-08-12T19:31:32.323Z"}}, "adp": [{"references": [{"url": "https://github.com/canonical/lxd/security/advisories/GHSA-7vp9-3vmp-c5jm", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T14:23:43.547083Z", "id": "CVE-2026-63295", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T14:24:15.556Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63295", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2026-07-16T09:49:29.911Z", "datePublished": "2026-08-12T19:31:32.323Z", "dateUpdated": "2026-08-13T14:24:15.556Z"}, "containers": {"cna": {"title": "Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated`", "descriptions": [{"lang": "en", "value": "An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges (such as enforcing restricted.containers.privilege=isolated), LXD fails to enforce the requirement if an instance configuration omits the security.idmap.isolated key. An attacker can exploit this flaw by creating or updating an instance without explicitly setting security.idmap.isolated, bypassing the target project's security constraints."}], "affected": [{"vendor": "Canonical", "product": "LXD", "packageName": "LXD", "platforms": ["Linux"], "repo": "https://github.com/canonical/lxd", "defaultStatus": "unaffected", "versions": [{"version": "4.0.0", "status": "affected", "versionType": "semver", "lessThan": "4.0.12"}, {"version": "5.0.0", "status": "affected", "versionType": "semver", "lessThan": "5.0.8"}, {"version": "5.21.0", "status": "affected", "versionType": "semver", "lessThan": "5.21.6"}, {"version": "6.0", "status": "affected", "versionType": "semver", "lessThan": "6.10"}]}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-863 Incorrect Authorization", "cweId": "CWE-863"}]}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "Accessing Functionality Not Properly Constrained by ACLs"}]}, {"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "Privilege Abuse"}]}, {"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "Privilege Escalation"}]}], "references": [{"url": "https://github.com/canonical/lxd/security/advisories/GHSA-7vp9-3vmp-c5jm", "tags": ["vdb-entry", "vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "source": {"discovery": "EXTERNAL"}, "solutions": [{"lang": "en", "value": "Upgrade to LXD version 4.0.12 or later, 5.0.8 or later, or 5.12.6 or later, or 6.10 or later."}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-08-12T19:31:32.323Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63295", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T14:23:43.547083Z"}}}], "references": [{"url": "https://github.com/canonical/lxd/security/advisories/GHSA-7vp9-3vmp-c5jm", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T14:24:03.827Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "LXD", "platforms": ["Linux"], "product": "LXD", "repo": "https://github.com/canonical/lxd", "vendor": "Canonical", "versions": [{"lessThan": "4.0.12", "status": "affected", "version": "4.0.0", "versionType": "semver"}, {"lessThan": "5.0.8", "status": "affected", "version": "5.0.0", "versionType": "semver"}, {"lessThan": "5.21.6", "status": "affected", "version": "5.21.0", "versionType": "semver"}, {"lessThan": "6.10", "status": "affected", "version": "6.0", "versionType": "semver"}]}], "source": "security@ubuntu.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "matchCriteriaId": "89DC62EE-69CD-4ACD-BB83-6A0635AC341C", "versionEndExcluding": "4.0.12", "versionStartIncluding": "4.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "matchCriteriaId": "59D070D6-84D2-400E-8260-EA52E5C60D37", "versionEndExcluding": "5.0.8", "versionStartIncluding": "5.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "matchCriteriaId": "575036D1-2B55-4043-B94A-1584E3F2DA37", "versionEndExcluding": "5.21.6", "versionStartIncluding": "5.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "matchCriteriaId": "374F5622-1D8F-4EF9-97E6-736C8220623B", "versionEndExcluding": "6.10", "versionStartIncluding": "6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges (such as enforcing restricted.containers.privilege=isolated), LXD fails to enforce the requirement if an instance configuration omits the security.idmap.isolated key. An attacker can exploit this flaw by creating or updating an instance without explicitly setting security.idmap.isolated, bypassing the target project's security constraints."}, {"lang": "es", "value": "Una vulnerabilidad de omisi\u00f3n de autorizaci\u00f3n en LXD permite a un atacante autenticado omitir las restricciones de aislamiento de contenedores a nivel de proyecto. Cuyo un proyecto est\u00e1 configurado con restricciones en los privilegios de los contenedores (como la aplicaci\u00f3n de \u2019restricted.containers.privilege=isolated\u2019), LXD no aplica el requisito si una configuraci\u00f3n de instancia omite la clave \u2019security.idmap.isolated\u2019. Un atacante puede explotar esta falla creyo o actualizyo una instancia sin establecer expl\u00edcitamente \u2019security.idmap.isolated\u2019, omitiendo las restricciones de seguridad del proyecto objetivo."}], "id": "CVE-2026-63295", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@ubuntu.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63295", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-13T14:23:43.547083Z", "version": "2.0.3"}}]}, "published": "2026-08-12T20:17:47.303", "references": [{"source": "security@ubuntu.com", "tags": ["Vendor Advisory", "Exploit"], "url": "https://github.com/canonical/lxd/security/advisories/GHSA-7vp9-3vmp-c5jm"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Vendor Advisory", "Exploit"], "url": "https://github.com/canonical/lxd/security/advisories/GHSA-7vp9-3vmp-c5jm"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security@ubuntu.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.0.12)"}}, {"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.0.8)"}}, {"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[5.21.0,5.21.6)"}}, {"platform": ["linux"], "status": "affected", "versions": {"scheme": "generic", "value": "[6.0,6.10)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "LXD", "source": "cna", "vendor": "Canonical"}, "product": "lxd", "vendor": "canonical"}], "created": "2026-08-12T20:45:08.710882+00:00", "updated": "2026-08-12T23:00:05.326136+00:00", "vendors": ["canonical", "canonical$PRODUCT$lxd"]}