CVE-2026-63300

Executive Summary

CVE-2026-63300 is an improper validation vulnerability in the instancePostMigration function of LXD's instance_post.go, affecting the LXD container management system. An authenticated attacker possessing can_create_instances permissions on a restricted project can bypass enforced project-level security restrictions by creating a disallowed or high-privilege instance in an unrestricted project and subsequently migrating it into the restricted project. With a CVSS score of 9.9, this vulnerability enables complete compromise of the host if a malicious instance is migrated into a restricted environment, making it a critical priority for any organization running LXD with multi-project isolation.

Technical Analysis

The vulnerability resides in the instancePostMigration function located in lxd/instance_post.go of the LXD codebase. The flaw is classified as CWE-862 (Missing Authorization) and stems from an improper validation mechanism during the instance migration process between projects.

Vulnerability Mechanism: LXD implements project-level security restrictions through configuration keys such as restricted.containers.lowlevel, restricted.devices.*, and restricted.networks.access. These restrictions enforce what types of containers, devices, and network configurations can be deployed within a given project. When an instance is created directly within a restricted project, LXD validates its configuration against these restrictions at creation time.

However, the instancePostMigration function fails to perform the same validation when an instance is migrated into a restricted project from an unrestricted one. The migration path bypasses the configuration validation step, treating the instance's pre-existing configuration as implicitly trusted.

Attack Surface: The attack surface is exposed to any authenticated LXD user with can_create_instances permissions on at least one unrestricted project. The attacker does not need elevated privileges within the restricted project itself — the flaw lies in the migration path, not in the restricted project's authorization checks.

Code-Level Analysis: The instancePostMigration function is expected to validate the instance configuration against the target project's restrictions before committing the migration. Due to improper validation, this check is either missing entirely or can be bypassed. The lack of validation means that any configuration that would be rejected during normal instance creation — those violating restricted.containers.lowlevel, restricted.devices.*, or restricted.networks.access — will be accepted when the instance arrives via migration.

The root cause is a missing authorization/validation check at the migration boundary. While the NVD description does not provide the specific code lines where the check should occur, the vulnerability class is clear: a trusted migration path fails to re-validate configuration against target-project policies.

Exploitation Scenarios

Step 1 — Reconnaissance and Target Identification: The attacker must first identify a LXD deployment with multiple projects, where at least one project is unrestricted (default project or explicitly configured without restrictions) and another is restricted. This information can be gleaned from API responses, documentation, or infrastructure configuration. The attacker must authenticate to the LXD API with permissions to create instances on the unrestricted project.

Step 2 — Triggering the Flaw: The attack chain is:

1. Authenticate to the LXD daemon with an account having can_create_instances permission on an unrestricted project.
2. Create a malicious instance in the unrestricted project that contains configuration elements which would be forbidden under the restricted project's policies (e.g., privileged containers, low-level container settings, raw device passthrough, or privileged network configurations).
3. Initiate an instance migration operation from the unrestricted project to the target restricted project using the LXD migration API.

The instancePostMigration function then processes the migration. Due to the missing validation, the malicious instance's configuration is accepted without cross-checking against the restricted project's restricted.* settings.

Step 3 — Payload and Execution: The payload is the instance configuration itself. Since the instance was created in an unrestricted environment, the attacker can configure privileged containers with host access (e.g., raw.lxc configuration, security.privileged=true, device passthrough for host devices). These configurations are the "payload" that breaks the restricted project's security envelope.

Step 4 — Post-Exploitation Impact: Once migrated, the attacker gains the ability to run containers inside the restricted project with configurations that violate the project's security policies. Depending on the specific bypassed restrictions, this can lead to host-level compromise (e.g., privileged container accessing docker sockets, host devices, or the LXD socket). At minimum, the attacker compromises the integrity of the restricted project's isolation boundaries, potentially laterally moving through the deployment.

Note: No public PoC is available; the attack chain is inferred from the vulnerability class and NVD description.

Impact Assessment

Business Impact: This vulnerability compromises the integrity of LXD's project-based isolation model, which is commonly used in multi-tenant environments for security boundary enforcement. A successful exploit grants an authenticated low-privileged user (PR:L) the ability to bypass security restrictions and execute arbitrary high-privilege containers within supposedly restricted environments.

CVSS Breakdown (Score 9.9):

• AV:N (Network) — Exploitable remotely via the LXD API
• AC:L (Low) — No special conditions required
• PR:L (Low) — Requires only low-privileged authentication
• UI:N (None) — No user interaction
• S:C (Changed) — The security scope changes; the attacked component (restricted project) is different from the vulnerable one (migration logic), and compromise extends to the host
• C:H/I:H/A:H (High/High/High) — Complete confidentiality, integrity, and availability compromise

Affected Systems: All LXD installations with project-based restrictions are potentially affected. The impact is amplified in multi-tenant environments where project boundaries serve as security trust boundaries.

Blast Radius: Extends beyond the restricted project itself. If the attacker can create privileged containers or raw device access, host kernel compromise is possible, which then leads to full cluster compromise in LXD deployments.

Detection Guidance

Note: The following detection rules are generic at the event-log/network level because no specific exploit payload or IoC is publicly known. Detection should focus on anomalous migration activities.

Sigma Rule

title: LXD Suspicious Project Migration Activity
id: 3d5f8e2a-7c4b-4e9f-9a1d-6b8c2d4f6a8e
status: experimental
description: Detects LXD instance migration events that may indicate CVE-2026-63300 exploitation attempts
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-63300
author: Valtersit Threat Intelligence
date: 2026/05/15
logsource:
    product: lxd
    service: lxd_api_events
detection:
    selection:
        event: instance_migrated
        source_project: "default"
    filter_restricted:
        target_project_contains:
            - "restricted"
    filter_known_operations:
        - lb_size: 50
    condition: selection AND filter_restricted AND NOT filter_known_operations
level: high
falsepositives:
    - Legitimate administrative migrations between projects
tags:
    - attack.privilege_escalation
    - cve.2026.63300

YARA Rule

rule LXD_Instance_Migration_Bypass {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects LXD instance configuration files containing restricted-device or privileged configurations"
        cve = "CVE-2026-63300"
        date = "2026-05-15"
    strings:
        $s1 = "security.privileged=true" ascii nocase
        $s2 = "restricted.devices" ascii nocase
        $s3 = "raw.lxc" ascii nocase
        $s4 = "restricted.containers.lowlevel" ascii nocase
        $s5 = "restricted.networks.access" ascii nocase
        $s6 = "instance_post.go" ascii nocase
    condition:
        (2 of ($s*)) and ($s1)
}

Suricata IDS Rule

alert http any any -> any any (msg:"LXD CVE-2026-63300 Suspicious Project Migration Attempt"; flow:established,to_server; content:"POST"; http_method; content:"/1.0/instances"; http_uri; content:"migration"; http_uri; content:"project"; http_uri; pcre:"/(restricted\.containers\.lowlevel|restricted\.devices|restricted\.networks\.access)/Ri"; classtype:attempted-admin; reference:cve,2026-63300; sid:202663300; rev:1;)

Elastic Detection

sequence by host.name with maxspan=5m
  [ authentication where event.action == "login" and user.name != null and process.name == "lxd" ]
  [ file where event.action == "write" and process.name == "lxd" and
     file.path ~= "*instance_post.go*" and
     file.extension == "go" ]
  [ network where process.name == "lxd" and
     destination.port == 8443 and
     network.protocol == "tls" ]

Note: EQL detection for this vulnerability is challenging due to the lack of public exploit indicators. The above rule detects anomalous changes to sensitive LXD source files, which may indicate exploitation attempts or malicious modifications.

Splunk SPL Query

index=lxd* sourcetype=lxd_api_logs
| WHERE event_type="instance_migrate" OR event_type="instance_post"
| spath input=response output=status path=metadata.status
| eval project_migration = if(source_project != target_project, "cross-project", "intra-project")
| where project_migration="cross-project"
| eval suspicious = if(match(request_body, "security.privileged=true") OR match(request_body, "raw.lxc") OR match(request_body, "restricted.devices.*"), "HIGHLY_SUSPICIOUS", "REVIEW")
| where suspicious="HIGHLY_SUSPICIOUS"
| table _time, user, source_project, target_project, instance_name, suspicious
| sort -_time

Wazuh OSSEC Rule

<group name="lxd,">
    <rule id="100633" level="12">
        <decoded_as>lxd_api</decoded_as>
        <field name="event_type">instance_migrate</field>
        <field name="target_project" type="pattern">restricted</field>
        <description>LXD: Cross-project instance migration to restricted project detected (CVE-2026-63300)</description>
        <group>lxd_security_alert,</group>
        <mitre>
            <id>T1213</id>
        </mitre>
    </rule>
    <rule id="100634" level="15">
        <decoded_as>lxd_api</decoded_as>
        <field name="event_type">instance_migrate</field>
        <field name="target_project" type="pattern">restricted</field>
        <field name="request_body" type="pattern">security.privileged</field>
        <description>LXD: Privileged container migration to restricted project - HIGH RISK (CVE-2026-63300)</description>
        <group>lxd_security_alert,</group>
        <mitre>
            <id>T1213</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. The vendor has not released a fix, and no workarounds have been officially documented.

Immediate Mitigations (compensating controls):

1. Disable cross-project migration — Revoke can_create_instances permission for all non-admin users on unrestricted projects. This prevents the first step of the attack chain.
2. Monitor restricted projects — Implement strict auditing on all migration events targeting restricted projects. Alert on any migration activity originating from unrestricted projects.
3. Network segmentation — Restrict LXD API access (port 8443) to trusted management networks only, reducing remote exploitation surface.
4. Principle of least privilege — Audit all users with can_create_instances and remove this permission where not strictly required. Consider separating admin operations from daily operations.
5. Manual validation — If possible, manually review any instance migrated into a restricted project for violations of restricted.* policies. Terminate and recreate any instance that violates restrictions.

Patch/Upgrade Steps:

1. Monitor LXD's official security announcements and CVE tracking pages for a patch.
2. Ensure LXD is updated to the latest available version as soon as a patch is released.
3. For now, check if any LXD version ships with a configuration-based workaround (e.g., disabling migration entirely) and apply it.

Long-Term Hardening:

1. Rearchitect deployment — Do not rely solely on LXD project restrictions as security boundaries; apply additional layer controls (SELinux/AppArmor profiles, cgroup limits, seccomp filters).
2. Immutable infrastructure — Enforce instance creation via IaC pipelines with pre-validated templates; disallow ad-hoc instance creation.
3. Regular security audits — Conduct periodic reviews of all LXD instances for compliance with project restrictions.
4. Multi-layer defense — Ensure host-level EDR/antivirus and kernel hardening are in place to catch post-exploitation behavior even if instance restrictions are bypassed.

References

1. NVD Entry for CVE-2026-63300 — https://nvd.nist.gov/vuln/detail/CVE-2026-63300
2. MITRE CWE-862 (Missing Authorization) — https://cwe.mitre.org/data/definitions/862.html
3. LXD Official Documentation on Project Restrictions — https://linuxcontainers.org/lxd/docs/master/projects/
4. LXD Security Announcements — https://github.com/canonical/lxd/security/advisories
5. CISA Known Exploited Vulnerabilities Catalog (CVE not listed as of this report) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Campaigns: No known threat actors are currently exploiting CVE-2026-63300 in the wild. No exploit-in-the-wild evidence exists. However, given the high CVSS score and the historical precedent of LXD and container-management vulnerabilities being targeted by cryptojacking campaigns (e.g., OVE-2018-0336, CVE-2019-18991), continuous monitoring is recommended.