CVE-2026-63297

Executive Summary

CVE-2026-63297 is a critical authorization bypass vulnerability in LXD, the container and virtual machine management daemon, caused by a time-of-check-to-time-of-use (TOCTOU) flaw during configuration merging in cross-project instance copies. An authenticated attacker with low privileges can exploit this timing window to copy instances with disallowed high-privilege configurations into restricted projects, circumventing project-based security restrictions. This vulnerability is currently unpatched and carries a CVSS score of 9.9, indicating critical severity with high impact on confidentiality, integrity, and availability.

Technical Analysis

The vulnerability resides in LXD's cross-project instance copy functionality. LXD enforces project-scoped restrictions to prevent users from deploying instances with configurations that exceed their permitted privilege level. During the copy operation, LXD is supposed to validate the target instance's configuration against the target project's restrictions before finalizing the copy.

The flaw occurs due to a sequencing error in the copy workflow. Specifically, LXD performs restriction checks before configuration merging is complete. This creates a race condition: the security validation evaluates the configurational state of the instance copy at a point in time when not all configuration elements have been merged into the final instance definition. An attacker can manipulate the timing of the operation — for example, by triggering configuration changes during the copy process — so that the restriction check evaluates a partially-merged configuration that does not yet include the restricted parameters. Once the check passes, the merge completes, bringing the disallowed high-privilege configuration into the target restricted project.

This is a classic time-of-check-to-time-of-use (TOCTOU) vulnerability, classified as CWE-367. The attack surface is the LXD REST API endpoint that handles instance copy operations across projects. The attacker must be authenticated to the LXD daemon (with at least minimal user access) and must have the ability to initiate cross-project copy operations. The privileged configurations that could be smuggled include, but are not limited to, resource allocations exceeding project quotas, privileged container modes, or access to restricted devices and storage pools.

The vulnerability is exploitable over the network (AV:N) with low attack complexity (AC:L) and requires only low privileges (PR:L) with no user interaction (UI:N). The scope is changed (S:C), meaning the compromised security boundary extends beyond the attacker's original permissions.

Exploitation Scenarios

Attack Chain (inferred from vulnerability class — no public PoC available):

1. Reconnaissance and Target Identification: The attacker authenticates to a LXD server and enumerates accessible projects. They identify a restricted target project (e.g., a production or multi-tenant project) and locate an existing instance they control in a less-restricted project.

2. Triggering the TOCTOU Flaw: The attacker initiates a cross-project copy operation of their controlled instance into the restricted target project. Simultaneously, they manipulate configuration elements — either by modifying the source instance's configuration during the copy, or by abusing API calls that cause configuration changes to be applied mid-copy. The goal is to ensure that when LXD performs the restriction check, the configuration appears compliant (e.g., standard resource limits, unprivileged mode), but the final merged configuration contains disallowed high-privilege settings (e.g., privileged mode, escalated resource limits, host device passthrough).

3. Payload at Vulnerability-Class Level: Because the check evaluates a partially-merged state, the attacker's malicious configuration passes validation. The merge completes after the check, yielding a fully-privileged instance inside the restricted project.

4. Post-Exploitation Impact: Once the high-privilege instance exists inside the restricted project, the attacker can leverage it to escape the container, read or exfiltrate data from other workloads in the same project, pivot to the host, and potentially access other projects or the underlying infrastructure. Given the CVSS subscores (C:H/I:H/A:H), the attacker gains complete control over confidentiality, integrity, and availability of the compromised resources.

Note: No public PoC is available; this attack chain is inferred from the TOCTOU vulnerability class and the NVD description. Exact API endpoints and configuration parameter names are not disclosed in public advisories.

Impact Assessment

Business Impact: This vulnerability undermines LXD's multi-tenancy security model. In environments where LXD is used to isolate workloads across teams, customers, or internal departments using projects, an attacker with the lowest tier of authenticated access can escalate to effectively unrestricted control within the target project and potentially the underlying host.

Affected Systems: All LXD deployments that expose cross-project instance copy functionality to unprivileged authenticated users. This includes multi-tenant hosting providers, internal infrastructure teams using project-based isolation, and any organization running LXD clusters with restrictive project policies.

Blast Radius: CVSS 9.9 (Critical). The attack requires only low-privilege authentication, is network-exploitable, has low complexity, and results in complete compromise (C:H/I:H/A:H). The changed scope (S:C) indicates the impact extends beyond the compromised project, potentially reaching the host kernel, storage backends, and adjacent projects. For containerized production workloads, this represents a critical risk of data exfiltration, service disruption, and lateral movement.

Detection Guidance

Sigma Rule

title: LXD Cross-Project Copy Configuration Race Condition
id: 3f7b1a9e-2c4d-5e6f-8a9b-0c1d2e3f4a5b
status: experimental
description: Detects LXD cross-project instance copy operations that may exploit TOCTOU vulnerability CVE-2026-63297
logsource:
    product: linux
    service: auditd
detection:
    selection_lxd_api:
        type: 'PROCTITLE'
        proctitle|contains: 'lxd'
    selection_copy_operation:
        type: 'SYSCALL'
        comm: 'lxd'
        syscall: 'execve'
    selection_project_copy:
        type: 'EXECVE'
        a0|contains: 'copy'
        a0|contains: 'project'
    condition: all of selection_*
level: high

YARA Rule

rule LXD_TOCTOU_Exploit_Patterns
{
    meta:
        author = "Valtersit SOC"
        description = "Detects LXD log patterns indicating cross-project copy attempts with race condition exploitation"
        cve = "CVE-2026-63297"
        date = "2026-01-01"
    strings:
        $s1 = "cross-project copy" ascii wide nocase
        $s2 = "project restriction" ascii wide nocase
        $s3 = "configuration merge" ascii wide nocase
        $s4 = "instance copy" ascii wide nocase
        $s5 = "restricted project" ascii wide nocase
        $s6 = "permission denied" ascii wide nocase
        $s7 = "POST /1.0/instances" ascii wide nocase
    condition:
        (uint16(0) == 0x5A4D or uint16(0) == 0x4D5A) and
        (3 of them) and
        ($s7 or $s1)
}

Suricata IDS Rule

alert http any any -> any any (msg:"LXD Cross-Project Copy TOCTOU Exploit Attempt"; flow:established,to_server; content:"POST"; http_method; content:"/1.0/instances"; http_uri; content:"target"; http_uri; content:"project"; http_uri; pcre:"/\/1\.0\/instances\/[a-zA-Z0-9_-]+\?target=[a-zA-Z0-9_-]+/Ui"; metadata:attack_target LXD, service HTTP, vulnerability CVE-2026-63297; classtype:attempted-admin; sid:202663297; rev:1;)

Elastic Detection

sequence by event.dataset with maxspan=1m
  [event.category: file, file.path: "/var/log/lxd/lxd.log", file.content: "copy"] 
  [event.category: file, file.path: "/var/log/lxd/lxd.log", file.content: "project"] 
  [event.category: file, file.path: "/var/log/lxd/lxd.log", file.content: "restriction"]

Splunk SPL Query

index=lxd sourcetype=lxd_logs 
| search "copy" AND "project" AND "restriction" 
| rex field=_raw "project=(?<project>\S+)" 
| rex field=_raw "target=(?<target>\S+)" 
| where source="*/1.0/instances/*" 
| stats count by src_ip, user, project, target, _time 
| sort - _time 
| table _time, src_ip, user, project, target, count

Wazuh OSSEC Rule

<rule id="202632" level="12">
  <if_sid>5500</if_sid>
  <match>copy|project|restriction</match>
  <regex>POST /1.0/instances</regex>
  <description>LXD cross-project copy operation - potential TOCTOU exploitation attempt</description>
  <mitre>
    <id>T1190</id>
  </mitre>
  <group>lxd, cve-2026-63297,</group>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

1. Immediate Mitigations:

   • Disable or restrict cross-project instance copy functionality for unprivileged users. If possible, revoke the copy permission for restricted projects entirely until a patch is available.
   • Enforce project restrictions at the network level by isolating LXD API access to trusted administrative networks only.
   • Monitor LXD audit logs for anomalous cross-project copy operations, especially those targeting restricted projects.
   • Apply defense-in-depth by running LXD instances with minimal Linux capabilities and using AppArmor/SELinux profiles.

2. Patch/Upgrade Steps:

   • No patch is currently available. Monitor the canonical LXD security advisory feed (https://discourse.ubuntu.com/c/lxd) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-63297) for updates.
   • Subscribe to LXD release notifications so that you can deploy the patched version immediately upon release.

3. Long-Term Hardening:

   • Implement strict RBAC and least-privilege access controls. Grant copy permissions only to trusted administrative accounts.
   • Use immutable infrastructure patterns to reduce the impact of container-level compromise.
   • Audit configuration of all instances in restricted projects regularly to identify any that contradict project restrictions — these may indicate successful exploitation.
   • Segment LXD management plane from general network traffic using firewalls or separate VLANs.
   • Maintain an active inventory of LXD API users and their permission levels; remove stale accounts promptly.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-63297
2. CWE-367 (TOCTOU) Reference: https://cwe.mitre.org/data/definitions/367.html
3. Canonical LXD Security Advisories: https://discourse.ubuntu.com/c/lxd
4. LXD Documentation (Projects & Restriction Features): https://linuxcontainers.org/lxd/docs/latest/
5. CISA Known Exploited Vulnerabilities Catalog (No entry — not KEV listed as of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: None confirmed at the time of writing. No public exploit code, PoC, or observed in-the-wild exploitation has been reported. However, given the critical CVSS score and the relatively simple TOCTOU nature of the flaw, active exploitation is plausible once public disclosure matures.