Loading vulnerability…
Authorization Bypass in LXD Cross-Project Cluster Migration
CVE-2026-62420 is an authorization bypass vulnerability in Canonical LXD affecting clustered deployments during cross-project instance migration. When an authenticated user initiates an instance move to a different project and a different cluster member using the instance migration API with migration enabled, the destination node processes the operation as an internal cluster notification and fails to enforce the target project's restriction checks. As a result, validation that should confirm the instance and its snapshots comply with the destination project's limits and restricted settings is skipped. This allows a user with valid access to perform a cross-project migration that introduces instance configurations that would normally be disallowed in the target restricted project.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated attacker to bypass project-level security restrictions in the destination project. This can result in placement of instances and associated configuration into restricted projects despite policy controls intended to block them. The practical impact is unauthorized introduction of disallowed instance characteristics into a protected project boundary, undermining tenant or administrative isolation and potentially enabling follow-on abuse depending on what project restrictions were meant to prevent.
If you can’t patch tonight, do this now.
Until patched, limit who can perform instance migration and cross-project move operations, especially in clustered LXD environments. Restrict administrative and API access to trusted users only, minimize use of restricted projects for workloads that can be moved across cluster members, and closely review authorization boundaries around project migration workflows. Additional defensive measures include monitoring and auditing cross-project migration activity and validating that cluster-internal operations cannot be abused to bypass policy enforcement.
Patch, then assume compromise.
Upgrade LXD to a version containing the fix that enforces target project restriction checks during cross-project instance moves in clustered environments. The corrective change adds explicit validation of the instance and its snapshots against the destination project's limits and restrictions before completing cross-project placement, including migration paths involving another cluster member. Apply Canonical-provided security updates and verify that backported fixes are present on supported stable branches.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.