CVE-2026-62420

Executive Summary

CVE-2026-62420 is an unpatched authorization bypass vulnerability in LXD, the Linux container hypervisor, allowing an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. By exploiting missing authorization checks on the destination cluster node during migration requests, a low-privileged attacker can introduce disallowed instance configurations into restricted projects, potentially achieving arbitrary code execution with elevated privileges. The vulnerability carries a CVSS base score of 9.9 (Critical) due to its network accessibility, low attack complexity, and high impact on confidentiality, integrity, and availability across a scope change to connected systems.

Technical Analysis

The vulnerability stems from an authorization bypass in LXD's project isolation mechanism when handling cross-project instance migrations. LXD implements project-based security boundaries to restrict what configurations, devices, and resources users can deploy within specific projects. During a normal instance migration, the API endpoint POST /1.0/instances/{name} with migration:true, project:, and target: is used to move an instance from one project to another, possibly across cluster members.

The flaw occurs on the destination cluster member when the migration request arrives as an internal cluster notification. LXD's internal cluster communication is trusted implicitly — notifications between cluster members are treated as already-authorized operations, bypassing normal project restriction validation on the receiving node. An authenticated attacker who can initiate a cross-project migration can exploit this trust boundary to supply instance configurations (devices, storage, profiles, resource limits, security policies) that would otherwise be forbidden in the destination project.

The root cause is that the destination node's request handler skips the entire set of project security restriction checks when the request's origin is identified as an internal cluster notification, rather than re-validating the payload against the destination project's restrictions. The distinction between an internal cluster message and an external API request is the sole gate for authorization — a classic confused-deputy problem where the cluster's trust token is conflated with authorization to mutate target project state.

The attack surface is the LXD API exposed over the network (typically TCP/8443 for the REST API). Authentication is required, but the required privilege is only "authenticated user" — not project-admin or operator. Any authenticated LXD user, including those restricted to a single project, can craft a migration request that references a target project with restricted policies. The vulnerability is triggered by the target cluster member's failure to validate the incoming instance configuration against project restrictions.

Exploitation Scenarios

The attack chain for CVE-2026-62420 is as follows:

1. Reconnaissance/Identification: An attacker first obtains a valid LXD account on a multi-project LXD deployment. This could be via legitimate provisioning (e.g., a cloud service offering LXD containers), compromised credentials, or an exposed registration portal. The attacker enumerates available projects, identifies restricted target projects, and determines which instance configurations (privileged devices, host-path mounts, raw.apparmor, raw.lxc, etc.) are blocked in that project.

2. Triggering the Flaw: The attacker initiates a cross-project instance migration by issuing POST /1.0/instances/{name} with parameters set: migration:true, project:, and target:. The attacker crafts the underlying instance configuration to include disallowed elements — for example, a privileged container, host filesystem bind mounts, or a raw.lxc directive that grants additional capabilities. Because the request is routed through the cluster notification channel, the destination node does not evaluate the configuration against the target project's restriction profiles.

3. Exploitation Technique: Because the injectable content is the instance configuration itself (YAML/JSON schema) rather than a code injection into a parser, the attacker leverages the LXD API's migration workflow logic. The mechanism is the authorization check order — the destination node processes the payload as if it were a trusted cluster-internal migration, bypassing ALL restrictions on project-level security policies.

4. Post-Exploitation Impact: Once the instance lands in the restricted project with elevated privileges (privileged containers, host path mappings, security.nesting enabled, etc.), the attacker achieves container escape primitives. The destination project's security posture is silently compromised. If the attacker can then execute code inside the container with these privileges, they can gain host-level access on the cluster member node. Given the cluster scope, a single member compromise can potentially pivot to other members' management plane.

No public PoC or exploit code is available at this time. The attack chain is inferred from the vulnerability class (authorization bypass via internal notification trust) and the API surface described in the NVD entry.

Impact Assessment

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H yields a base score of 9.9 (Critical). Key impact dimensions:

• Confidentiality (High): An attacker can gain access to host files that the restricted project was designed to isolate, including other tenants' data, secrets, and configuration files.
• Integrity (High): An attacker can modify host files, install persistent backdoors, and alter the state of cluster infrastructure.
• Availability (High): Privileged container access could allow kernel module loading, resource exhaustion, or shutdown of cluster members.
• Scope (Changed): The impact extends beyond the container/project to the underlying host OS and potentially the entire LXD cluster.

The business blast radius targets: multi-tenant LXD hosting providers (public clouds, managed container services), enterprises running LXD clusters for internal isolation of teams/environments, and any deployment where "restricted projects" are relied upon as a security boundary. Loss of project isolation in a multi-tenant environment effectively defeats one of LXD's core security features — any downstream compliance or audit control that depends on project boundaries is void.

Given the CVSS score and the absence of a patch, this vulnerability should be treated as a critical security incident. Any deployment that has multiple projects with different restriction profiles, or that uses LXD project restrictions to isolate tenants, is at risk.

Detection Guidance

The following detection rules target signs of cross-project migration activity, unusual instance configuration payloads, and traversal of the internal cluster notification path.

Sigma Rule

title: LXD Cross-Project Migration Bypass Activity
id: 8f3e4dab-2c91-4d55-9e2a-7b6f1c4e8a02
status: experimental
description: Detects LXD cross-project instance migration attempts that may indicate exploitation of authorization bypass (CVE-2026-62420).
logsource:
  product: linux
  category: process_creation
detection:
  selection_lxd:
    Image|endswith: 
      - 'lxd'
      - 'lxd-user'
    CommandLine|contains|all:
      - 'migrate'
      - 'project'
  selection_curl:
    CommandLine|contains|all:
      - 'curl'
      - '/1.0/instances/'
      - 'migration'
      - 'project='
    CommandLine|contains:
      - 'target='
  condition: selection_lxd or selection_curl
  level: high
falsepositives:
  - Legitimate administrative migrations between projects
fields:
  - CommandLine
  - User
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2026-62420

YARA Rule

rule lxd_cross_project_migration_bypass {
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects LXD API responses or configs referencing cross-project migration with target member - possible CVE-2026-62420"
        date = "2026-01-15"
        score = 60
        cve = "CVE-2026-62420"
    strings:
        $s1 = "migration" ascii
        $s2 = "instance" ascii
        $s3 = "target" ascii
        $s4 = "project" ascii
        $s5 = "cluster" ascii nocase
        $s6 = "restriction" ascii nocase
        $s7 = "privileged" ascii nocase
    condition:
        uint16(0) == 0x5B7B and  // { [ or {  — begin JSON API object
        all of ($s1, $s2, $s3, $s4) and
        1 of ($s5, $s6, $s7) and
        filesize < 1MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"LXD CVE-2026-62420 - Cross-Project Migration with Target Member"; flow:to_server,established; content:"POST"; http_method; content:"/1.0/instances/"; http_uri; content:"migration"; http_client_body; content:"project"; http_client_body; pcre:"/(migration.*project.*target|target.*project.*migration)/i"; reference:cve,2026-62420; classtype:attempted-admin; sid:202662420; rev:1; priority:1;)

Elastic Detection

sequence by process.entity_id with maxspan=10s
  [ network where event.type == "start" and network.transport == "tcp" and destination.port == 8443
    and process.name in ("lxd", "lxd-user") ]
  [ file where event.action == "rename" and process.name in ("lxd", "lxd-user")
    and file.path like "*project*" ]

Splunk SPL Query

index=main sourcetype=lxd_api OR sourcetype=lxd_log
| where match(_raw, "(?i)migration")
| where match(_raw, "(?i)project=") 
| where match(_raw, "(?i)target=")
| search "/1.0/instances/" OR path="/1.0/instances/"
| table _time, src_ip, user, http_method, uri_path, client_body
| eval exploit_attempt = if(match(client_body, "(?i)privileged|security\.privileged|raw\.lxc|security\.nesting|security\.privileged=true"), "HIGH_CONFIDENCE", "OBSERVE")
| where exploit_attempt = "HIGH_CONFIDENCE"
| stats count by src_ip, user, dst_host

Wazuh OSSEC Rule

<group name="lxd,">
  <rule id="100624" level="12">
    <decoded_as>json</decoded_as>
    <field name="url" type="pcre2">/1\.0/instances/.*</field>
    <field name="method" type="pcre2">POST</field>
    <field name="body" type="pcre2">migration</field>
    <field name="body" type="pcre2">project</field>
    <field name="body" type="pcre2">target</field>
    <description>CVE-2026-62420: LXD cross-project migration request with target member - possible authorization bypass</description>
    <group>lxd_cve_2026_62420,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence is available from any tracked source. Until a fix is released and verified, the following interim mitigations are recommended:

1. Immediate Mitigations:

   • Restrict LXD API access to trusted networks/VPNs only; place the API behind a strict firewall rule allowing access only from administration jump-hosts.
   • Disable cross-project migration if not absolutely required. This can typically be achieved via a custom authorization policy or by setting all projects to have identical restrictions, removing the differential trust boundary.
   • Revoke API credentials for any user who does not explicitly require migration capability.
   • If possible, isolate cluster members so that only the control-plane node can initiate cross-member API calls.

2. Patch/Upgrade Steps:

   • Subscribe to LXD security announcements (canonical-lxd mailing list / GitHub releases).
   • Once a patch is released, upgrade ALL LXD nodes in the cluster to the patched version.
   • Validate cluster health post-upgrade with a controlled migration test across projects.

3. Long-term Hardening:

   • Re-evaluate reliance on LXD project restrictions as a security boundary for untrusted tenants. Consider including LXD integration with a privileged access management (PAM) solution.
   • Enable full audit logging of API requests, especially those containing migration parameters.
   • Implement anomaly detection on migration patterns — a low-privileged user performing cross-project, cross-member migrations should trigger alerting.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-62420
2. LXD Project Homepage / Security Advisory Page: https://linuxcontainers.org/lxd/introduction/ (check for future advisories)
3. CWE-863 (Incorrect Authorization): https://cwe.mitre.org/data/definitions/863.html
4. MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/

Campaign Info: No known threat actor campaigns, exploit-in-the-wild evidence, or CISA KEV listing at the time of writing. The vulnerability is unpatched; monitoring for emerging threat activity is strongly advised.