CVE-2026-63296

Executive Summary

CVE-2026-63296 is a critical authorization bypass vulnerability (CVSS 9.9) in LXD, the Linux container management platform. An authenticated attacker can bypass target project restrictions during instance migration by supplying configuration overrides that are not validated against the destination project's enforced security policies. Successful exploitation allows migration of instances carrying high-privilege configurations into restricted projects, effectively bypassing multi-tenancy isolation controls. The vulnerability is currently unpatched (patch confidence 0/4), and no public exploit code or CISA KEV listing exists at the time of writing.

Technical Analysis

The vulnerability resides in LXD's instance migration workflow. LXD supports project-based multi-tenancy where administrators enforce per-project restrictions—such as limits on privileged containers, device passthrough, resource quotas, or security profiles. During a standard instance migration from one project to another (e.g., via lxd-migrate, project copy operations, or the LXD API's migration endpoints), the system is expected to validate that the instance's final configuration complies with the destination project's enforcement rules.

The flaw is that LXD accepts configuration overrides during migration without re-validating them against the target project's restrictions. In normal operation, when an instance is created or updated directly within a project, LXD's validation layer applies the project's limits (e.g., restricted.privileged, restricted.devices.*, restricted.containers.nesting). However, the migration code path either:

1. Skips the validation step entirely for certain override parameters, or
2. Validates against the source project's restrictions rather than the destination project's, or
3. Applies overrides after the initial validation pass, allowing the attacker to substitute disallowed settings.

The attack surface is the LXD REST API and its migration control channel. An authenticated user—even with minimal privileges—who can initiate a migration operation and supply configuration overrides can craft a migration request where the instance's post-migration configuration violates target-project restrictions. Because the validation is absent or misplaced, the migration succeeds, and the instance lands in the restricted project with high-privilege settings (e.g., privileged container flag, host device mounts, or nested container support) that should have been blocked.

The vulnerability class is CWE-863 (Incorrect Authorization). The CVSS vector highlights the severity: network-exploitable (AV:N), low attack complexity (AC:L), requires low privileges (PR:L), no user interaction (UI:N), and has scope change (S:C) because the compromised project boundary expands the impact. Confidentiality, integrity, and availability impacts are all rated High.

No specific code-level identifiers (function names, API endpoints, file paths) are disclosed in the NVD description, so the mechanism is described at the class level. The precise validation bypass location within LXD's codebase is not publicly documented.

Exploitation Scenarios

Note: No public PoC exists at the time of writing. The attack chain below is inferred strictly from the NVD description and vulnerability class. Specific function names, API parameters, or request structures are not fabricated.

Step 1 — Reconnaissance / Target Identification The attacker first authenticates to the LXD daemon (via the REST API, lxc CLI, or a client library). They enumerate available projects and identify a restricted project whose enforced policies would prohibit high-privilege configurations (e.g., a project with restricted.privileged=true blocking privileged containers, or one with device restrictions). The attacker also locates an instance they own or can migrate that currently resides in a less-restricted project, or creates a new instance with the disallowed configuration in their own project.

Step 2 — Triggering the Vulnerability Class The attacker initiates an instance migration operation targeting the restricted project. During this operation, they supply configuration overrides—i.e., a set of settings to be applied to the instance as part of the migration—that include values the destination project would normally forbid (e.g., setting the privileged flag to true, adding a host path device mount, or enabling nesting). The flaw: LXD processes these overrides without validating them against the destination project's restricted.* settings.

Step 3 — Payload / Execution Method The attack payload is the malformed migration request itself. The attacker must structure the request such that:

• The source instance has a configuration that is valid in the source project.
• The override block contains the disallowed high-privilege settings.
• The migration target project is the restricted one.

Because the validation check is missing/broken only on the override path, the migration completes. The attacker need not possess any special administrative role beyond the ability to perform migrations—which is typically granted to authenticated users with appropriate write access to their own instances.

Step 4 — Post-Exploitation Impact Once the instance lands in the restricted project with the high-privilege configuration, the attacker achieves:

• Privilege escalation within the host: A privileged container or a container with host device passthrough can be used to break out of container isolation and compromise the LXD host.
• Cross-project boundary violation: The trusted project's policy is silently violated, undermining the multi-tenancy security model. Other tenants' resources in the same project may now be exposed to the attacker's container if host-level compromise is achieved.
• Lateral movement: From the host, the attacker may move to other projects, other containers, or connected networks.
• Persistence: The attacker can maintain the modified configuration and, given the unpatched state, repeat the migration on other instances.

Given CVSS subscores (C:H/I:H/A:H, S:C), the worst-case outcome is full host compromise with total loss of confidentiality, integrity, and availability of the affected LXD infrastructure.

Impact Assessment

• Business Impact: LXD is widely used in multi-tenant container environments (private clouds, DevOps platforms, service providers offering container-as-a-service). A successful exploit breaks the tenant isolation boundary, allowing a low-privileged attacker to achieve host-level compromise. This can lead to data exfiltration from all tenants on the host, service disruption, and reputational damage.
• Affected Systems: All LXD deployments that use projects with enforced restrictions (restricted.* settings) and allow instance migration across project boundaries. The exact affected version range is not disclosed (affected versions list is empty in the source data), making it impossible to scope the exposure precisely. Any LXD environment exposing migration capabilities to authenticated users is presumptively vulnerable until a patch is issued.
• Blast Radius: The CVSS scope change (S:C) indicates the compromised component's impact extends beyond the LXD instance itself to the host OS and any co-tenant resources. With A:H, the availability impact includes potential denial of service via malicious container behavior.
• Exploitability in the Wild: No exploit-in-the-wild evidence, no CISA KEV listing, and no public PoC are currently reported. However, the low complexity of access (authenticated, network-accessible) and the severe impact make active exploitation highly likely once a working exploit circulates.

Detection Guidance

Detection is challenging because the vulnerability is an authorization logic flaw rather than a signature-based attack. However, monitoring for abnormal migration patterns and configuration anomalies can surface exploitation attempts.

Sigma Rule

title: LXD Instance Migration with Disallowed Configuration Override
id: 4a8c7e2b-9f1d-4c6e-8a3d-2f5b9c1e7a4d
status: experimental
description: Detects LXD API migration requests that include configuration overrides targeting restricted projects, potentially exploiting CVE-2026-63296.
logsource:
  category: application
  product: lxd
detection:
  selection:
    EventType: "instance.migration"
    TargetProject: "*restricted*"
  filter_known_good:
    InitiatedBy: "admin"   # Adjust to known legitimate admin accounts
  condition: selection and not filter_known_good
falsepositives:
  - Legitimate administrative migrations with overrides
  - Migration to projects named without "restricted" keyword (custom naming)
level: high
tags:
  - attack.tactic.privilege-escalation
  - attack.technique.t1068
  - cve.2026-63296

YARA Rule

rule LXD_Migration_Unauthorized_Bypass {
    meta:
        author = "ValtersIT Threat Intel"
        description = "Detection rule for CVE-2026-63296 suspicious LXD migration patterns"
        cve = "2026-63296"
        date = "2026-02-15"
    strings:
        $a = "migration" ascii nocase
        $b = "restricted.privileged" ascii nocase
        $c = "restricted.devices" ascii nocase
        $d = "target_project" ascii nocase
        $e = "override" ascii nocase
    condition:
        all of them
}

Note: This rule is best applied to log files or API request payloads captured from LXD traffic. It flags configurations that combine migration operations with restricted-key overrides.

Suricata IDS Rule

alert http any any -> any any (msg:"LXD Migration Request with Restricted Override"; flow:established,to_server; content:"/1.0/instances/"; nocase; pcre:"/restricted\.(privileged|devices|containers)/Ui"; pcre:"/migration|target_project|override/Ui"; classtype:attempted-admin; sid:6332961; rev:1; metadata:affected_product LXD, cve 2026-63296, tag authorization-bypass;)

Note: LXD API typically uses Unix sockets or HTTPS. This rule targets the HTTPS-facing API. Adjust to tls or other protocol handlers if the deployment uses plain HTTP on a management interface.

Elastic Detection

sequence by host.name, initiator.name with maxspan=15m
  [file where event.action == "migration_request" and
   process.name == "lxd" and
   message like "*target_project*restricted*"]
  [file where event.action == "migration_complete" and
   process.name == "lxd" and
   message like "*privileged=true*" or message like "*devices*host*"] 

Note: Assumes LXD emits structured logs with fields (host.name, initiator.name). Rate-limiting or anomaly detection on migration volume per user may also be viable if structured logs are unavailable.

Splunk SPL Query

index=lxd sourcetype=lxd:migrations
| where like(EventType, "%migration%") AND like(TargetProject, "%restricted%")
| eval dangerous_override = if(match(ConfigOverrides, "(?i)(privileged|devices|nesting).*true"), 1, 0)
| where dangerous_override = 1
| table _time, User, SourceProject, TargetProject, InstanceName, ConfigOverrides
| sort -_time

Wazuh OSSEC Rule

<group name="lxd,">
  <rule id="632960" level="12">
    <if_sid>63</if_sid>
    <match>migration</match>
    <match>restricted</match>
    <match>override</match>
    <description>LXD instance migration with config overrides to a restricted project (CVE-2026-63296 attempt)</description>
    <group>cve-2026-63296,</group>
  </rule>
</group>

Note: Rule IDs and parent if_sid values must be adapted to your Wazuh environment and local LXD log parsing.

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor advisory, no fix version, no patch commit referenced in any tracked source at the time of this writing. The vendor (LXD project / Canonical) has not yet released a public fix.

1) Immediate Mitigations (defense-in-depth while unpatched):

• Restrict migration capability: If migration is not required for all tenants, disable instance migration at the project or daemon level. Use LXD's authorization policies to limit migration operations to a trusted admin group only.
• Enforce project restrictions at the network layer: Isolate LXD API access behind a VPN or allowlist. Do not expose the LXD API to untrusted networks (even authenticated).
• Audit existing projects: Review all projects with restricted.* settings. Query the current configurations of all instances to ensure none already carry disallowed settings (i.e., that no predecessor bypass already happened).
• Enable audit logging: Ensure LXD audit logs (API request/response logging) capture migration events, including user identity, source/target project, and payload overrides. This is critical for detecting in-progress exploitation.

2) Patch/Upgrade Steps (once available):

• Monitor the LXD GitHub repository (github.com/canonical/lxd) and the official LXD security announcements channel (discuss.linuxcontainers.org) for a security release.
• When a patched version ships, upgrade all LXD daemons (server and clients) to the fixed version. Test the upgrade in a staging environment replicating project restrictions.
• After patching, re-run the project enforcement validation to confirm the bypass is closed: attempt a migration with disallowed overrides into a restricted project and verify it is rejected.

3) Long-Term Hardening:

• Apply the principle of least privilege to all LXD users. Do not grant migration permissions by default.
• Implement mandatory project restriction audits: script periodic checks that compare every instance's effective configuration against its project's enforced restrictions, alerting on any mismatch (this catches both this CVE and any future similar validation gaps).
• Adopt a policy of regular security reviews for LXD code changes, particularly around migration and project-boundary logic.
• Consider running LXD containers with additional isolation layers (e.g., user namespaces) so that even a "privileged" container has limited host access as defense-in-depth.

Workarounds: N/A — No vendor-provided workaround exists.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-63296
2. LXD Project Official Repository — https://github.com/canonical/lxd
3. LXD Security Announcements Forum — https://discuss.linuxcontainers.org/c/security-announcements/
4. CWE-863: Incorrect Authorization — https://cwe.mitre.org/data/definitions/863.html
5. CISA Known Exploited Vulnerabilities Catalog (not listed at time of writing) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Activity: No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-63296 at the time of this report. The high CVSS score and unpatched state warrant immediate monitoring for emerging exploit code.