critical9.9
CVE-2026-63299
An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits.
Impact
An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil (Config == nil). An attacker can exploit these flaws to allocate storage resources that exceed the administrative limits configured for a project.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Canonical | Lxd | from 5.0.0 before 5.0.8 from 5.1 before 5.21.6 from 6.0 before 6.10 |