CVE-2026-63299

Executive Summary

CVE-2026-63299 is an authorization bypass vulnerability in LXD, the system container and virtual machine manager maintained by Canonical. The flaw permits an authenticated user to bypass project-level disk and volume limits by exploiting two distinct code paths within storage volume operations. A successful attacker can allocate storage resources exceeding administrative limits, leading to resource exhaustion, denial of service, and potential lateral impact across projects due to the high CVSS score of 9.9. Currently unpatched, this vulnerability poses an immediate risk to all LXD deployments that rely on project-based resource quotas for multi-tenancy isolation.

Technical Analysis

The vulnerability resides in the LXD storage volume management subsystem and manifests through two related but distinct code path deficiencies. LXD's project-based resource limiting is designed to enforce administrative constraints on storage allocation per project; these two flaws circumvent that enforcement.

The first affected code path is in the storagePoolVolumeTypePostMove function. This function handles the movement of a storage volume from one project to another. During this operation, the code fails to invoke the limits.AllowVolumeCreation check, which is the authorization gate that validates whether the target project has sufficient remaining quota to accommodate the new volume. Without this check, a volume can be moved into a project even when that project's storage limits have already been exhausted or when the volume's size exceeds the remaining allowance.

The second affected code path involves volume snapshot restore operations. When restoring a volume from a snapshot, the code is expected to perform an AllowVolumeUpdate check to ensure the restored volume remains within project limits. However, this check is skipped entirely when the volume configuration is nil (Config == nil). This condition creates a bypass: an attacker can restore a snapshot with an empty configuration, and the system will not validate whether the resulting volume complies with the project's storage constraints.

Both flaws share a common root cause: incomplete enforcement of resource limit checks across all volume operation code paths. The severity is amplified by the fact that these operations are exposed through the LXD API, which is typically network-accessible. LXD's REST API uses a unix socket by default but is frequently exposed over TCP for remote management, making this vulnerability remotely exploitable by any authenticated user.

The attack surface includes any LXD installation exposed over the network with at least one legitimate user account. The exploit requires only low-privileged authentication (PR:L in the CVSS vector), and no user interaction is required (UI:N). The vulnerability has a changed scope (S:C), indicating that a successful exploit can impact resources beyond the vulnerable component's security domain — meaning a single project's quota bypass can affect the entire LXD host and other projects.

Exploitation Scenarios

No public PoC is currently available for this vulnerability; the attack chain described below is inferred from the vulnerability class and the NVD description.

Step 1 — Reconnaissance/Target Identification: An attacker identifies LXD instances exposed over the network, typically on TCP port 8443 (the default HTTPS port for the LXD REST API). Services such as Shodan or Censys can be used to locate exposed instances. The attacker requires a valid account, which could be obtained through credential stuffing, brute force, or legitimate low-privilege access such as a compromised developer account. Alternatively, in multi-tenant environments, the attacker may already legitimately possess a low-privileged account.

Step 2 — Triggering the Flaw Class: The attacker authenticates via the LXD REST API. Two primary exploitation vectors exist:

1. Volume Movement Bypass: The attacker identifies existing storage volumes in a project where they have authorization. Using the volume move operation (storagePoolVolumeTypePostMove path), they move a volume from one project to another — specifically into a target project that has already reached its storage quota. Because the limits.AllowVolumeCreation check is skipped, the move succeeds despite exceeding the target project's limits.

2. Snapshot Restore Bypass: The attacker takes a snapshot of an existing volume or identifies an existing snapshot. They then initiate a snapshot restore operation while ensuring the volume configuration is nil (Config == nil). This causes the AllowVolumeUpdate check to be skipped, allowing the restored volume to exceed the project's storage limit.

Step 3 — Payload/Execution Method: At the vulnerability-class level, this is a resource-limit circumvention achieved through API request manipulation. The attacker crafts API requests to the storage volume endpoints, specifying the volume/snapshot to move or restore and the target project. No code execution payload is required; the attack is purely a matter of unauthorized resource allocation through incomplete validation logic.

Step 4 — Post-Exploitation Impact: After successful exploitation, the attacker can consume arbitrary amounts of storage beyond their allocated project quota. This can be escalated to: (a) fill the underlying storage device, causing denial of service for all LXD projects on the host; (b) create excessive snapshots or volumes to exhaust inodes or IOPS; (c) in scenarios where storage quotas protect against tampering, the bypass enables further abuse of the storage subsystem with C:H/I:H/A:H (high confidentiality, integrity, and availability impact per the CVSS vector). The changed scope (S:C) means the impact extends beyond the immediate container project to the entire LXD host.

Impact Assessment

CVSS Score: 9.9 (Critical) — The severity is driven by the network attack vector with low attacker complexity and low privilege requirements. The changed scope and high confidentiality, integrity, and availability impacts indicate that exploitation can lead to full compromise of the storage layer.

Business Impact: LXD is commonly used for container-based infrastructure, multi-tenant hosting, and edge computing. Organizations relying on LXD project quotas for cost control, resource governance, or regulatory compliance face a direct bypass of these controls. In a multi-tenant environment, one tenant can consume resources allocated to others, potentially violating service level agreements and enabling resource-based denial-of-service against co-tenant workloads.

Affected Systems: All LXD installations that use project-based storage quotas are affected. This includes LXD standalone deployments, Proxmox VE (which embeds LXD), and environments where LXD is managed via the lxc CLI or through the REST API. Deployments that have not enabled project quotas are not functionally impacted, although the vulnerability class remains present.

Blast Radius: The changed scope (S:C) means the impact extends across the entire LXD host. Storage exhaustion can crash the host's filesystem operations, affect all running containers and VMs, and potentially cause data loss on volumes that cannot be written. The unpatched status amplifies the risk — organizations cannot remediate through vendor patches and must rely on compensating controls.

Exploitation Likelihood: Given the critical CVSS score, the straightforward nature of the API manipulation, and the lack of any active patch, exploitation activity is likely in the near term once the vulnerability becomes public knowledge beyond the CVE disclosure. The lack of a public PoC currently provides some buffer, but this is expected to change as researchers and attackers analyze the CVE description.

Detection Guidance

Sigma Rule

title: LXD Storage Volume Quota Bypass via Move or Snapshot Restore
id: 8f3c9a1e-5d2b-4c7a-9e1f-6b8d2a4c0e31
status: experimental
description: Detects LXD API requests attempting to move volumes across projects or restore snapshots with nil configuration, which may indicate attempts to bypass project-level storage limits.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-63299
author: Valtersit Threat Intelligence
date: 2026/05/15
logsource:
    product: linux
    service: lxd
detection:
    selection_move:
        api_endpoint|contains: '/1.0/storage-pools'
        api_method: 'POST'
        action|contains: 'move'
    selection_snapshot:
        api_endpoint|contains: '/snapshots'
        api_method: 'POST'
        config|contains: 'null'
    condition: selection_move or selection_snapshot
level: high
falsepositives:
    - Legitimate administrative operations moving volumes between projects with sufficient quota
    - Routine snapshot restores where config is nil
tags:
    - attack.t1190
    - cve.2026-63299

YARA Rule

rule LXD_Quota_Bypass_CVE_2026_63299
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects LXD source code references to vulnerable storage volume functions and missing quota checks"
        cve = "CVE-2026-63299"
        date = "2026-05-15"
        severity = "critical"
    strings:
        $func1 = "storagePoolVolumeTypePostMove" ascii wide
        $func2 = "AllowVolumeCreation" ascii wide
        $func3 = "AllowVolumeUpdate" ascii wide
        $nilcheck = "Config == nil" ascii wide
        $limpath = "limits.AllowVolume" ascii wide
    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464c457f) and
        (
            ($func1 and $func2) or
            ($func3 and $nilcheck) or
            ($func1 and $limpath and not $func2)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"LXD Storage Volume Quota Bypass Attempt (CVE-2026-63299)"; flow:to_server,established; content:"POST"; http_method; content:"/1.0/storage-pools"; http_uri; content:"move"; http_uri; nocase; content:"target"; http_client_body; metadata:cve CVE-2026-63299; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-63299; sid:202663299; rev:1;)

Elastic Detection

// Detect LXD API requests to storage pool move endpoints or snapshot restore with nil config
network where process.executable == "/usr/bin/lxd" or process.name == "lxd"
  and event.action in ("connection_accepted", "connection_established")
  and not source.ip : ("127.0.0.1", "::1")
  and (
    // Volume move operation
    (network.protocol == "http" and url.path contains "/1.0/storage-pools"
      and url.path contains "move")
    OR
    // Snapshot restore with configuration manipulation
    (network.protocol == "http" and url.path contains "/snapshots"
      and url.query contains "restore" and url.query contains "config")
  )

Splunk SPL Query

index=proxy OR index=network
| where like(uri_path, "%/1.0/storage-pools%") 
| transaction src_ip, user maxspan=10m
| where like(uri_path, "%move%") OR like(uri_path, "%restore%")
| table _time, src_ip, user, uri_path, http_method, status
| eval threat_score = case(
    like(uri_path, "%/1.0/storage-pools/%/volumes%") AND http_method="POST", 8,
    like(uri_path, "%/snapshots%") AND like(uri_path, "%restore%"), 8,
    5)
| where threat_score >= 8
| sort - _time
| output_csv lxd_quota_bypass_attempts.csv

Wazuh OSSEC Rule

<group name="lxd, cve-2026-63299,">
  <rule id="820414" level="12">
    <if_sid>5715</if_sid>
    <match>storage-pools</match>
    <match>move|restore</match>
    <description>LXD: Possible storage volume quota bypass attempt (CVE-2026-63299)</description>
    <group>lxd_quota_bypass,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <references>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-63299</url>
    </references>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: CRITICAL — This vulnerability is UNPATCHED. Patch confidence is 0/4 with no evidence of a fix from any tracked source. There is currently no vendor advisory and no patched version identified.

1) Immediate Mitigations

• Restrict API network exposure: The LXD API should not be exposed to untrusted networks. If remote access is required, place the API behind a VPN or bastion host to enforce mutual TLS with client certificates.
• Enforce least-privilege authentication: Review all LXD user accounts and remove unnecessary users. Require client-certificate authentication rather than password-based authentication where possible.
• Disable volume move across projects: If not operationally necessary, restrict users from moving storage volumes between projects. This can be done by removing the storage_move API permission from user roles via the LXD RBAC mechanism.
• Restrict snapshot restore privileges: Limit which users can restore volume snapshots. Require elevated privileges for restore operations using LXD's built-in authorization.
• Monitor storage utilization: Set up alerting on storage pool usage. Any project that exceeds its quota should trigger an immediate alert for investigation.

2) Patch/Upgrade Steps

No official patch is currently available. Organizations should:

• Subscribe to Canonical's security notices for LXD (available at https://ubuntu.com/security/notices) and monitor the LXD GitHub repository for fix releases.
• Test any upcoming LXD releases in a staging environment before production rollout.
• If you run LXD through a distribution package (e.g., Ubuntu's lxd snap), monitor the snap channel for updates and be prepared to refresh the snap immediately when a patched version is published.

3) Long-Term Hardening

• Enable LXD's RBAC: Implement role-based access control to ensure users only have the minimum permissions required for their functions.
• Use storage resource limits at the host level: In addition to LXD project quotas, configure underlying filesystem quotas (e.g., quota on ext4 or xfs_quota) to provide a second layer of enforcement.
• Audit storage operations: Enable auditd on the LXD host to capture all storage pool and volume API calls. This provides forensic evidence if exploitation occurs before detection rules are effective.
• Segment multi-tenant workloads: Do not host tenants with different trust levels on the same LXD instance until this vulnerability is patched. Use separate virtual machines or hosts for high-risk tenants.
• Implement file integrity monitoring: Monitor the LXD binary and configuration files for unauthorized modification, as an attacker who bypasses quotas may attempt to tamper with LXD's authorization configuration.

References

1. NVD Entry for CVE-2026-63299: https://nvd.nist.gov/vuln/detail/CVE-2026-63299
2. LXD Official Documentation (Storage quotas and projects): https://linuxcontainers.org/lxd/docs/master/projects/
3. Canonical Ubuntu Security Notices: https://ubuntu.com/security/notices
4. LXD GitHub Repository (for patch releases): https://github.com/canonical/lxd
5. CWE-770 Allocation of Resources Without Limits or Throttling: https://cwe.mitre.org/data/definitions/770.html

Threat Actor Activity: No known threat actor campaigns or exploit-in-the-wild evidence has been reported at the time of this analysis. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. However, given the critical severity and the unpatched status, organizations should treat this as a high-priority risk and monitor for emerging exploitation activity in the immediate term.