Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-63300

An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker with can_create_instances permissions on a restricted project to bypass project-level security restrictions. When migrating an instance between projects, LXD fails to validate the instance's configuration against the target project's enforced restrictions (such as restricted.containers.lowlevel, restricted.devices.*, and restricted.networks.access). An attacker can exploit this by creating a disallowed or high-privilege instance in an unrestricted project and subsequently moving it into the restricted project.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 29.1%
CVSS Severity
CVSS v3 Score 9.9
Products affected by CVE-2026-63300
  • Canonical » Lxd » Version: 5.0.0
    cpe:2.3:a:canonical:lxd:5.0.0
  • Canonical » Lxd » Version: 5.0.1
    cpe:2.3:a:canonical:lxd:5.0.1
  • Canonical » Lxd » Version: 5.0.2
    cpe:2.3:a:canonical:lxd:5.0.2
  • Canonical » Lxd » Version: 5.0.3
    cpe:2.3:a:canonical:lxd:5.0.3
  • Canonical » Lxd » Version: 5.0.4
    cpe:2.3:a:canonical:lxd:5.0.4
  • Canonical » Lxd » Version: 5.0.5
    cpe:2.3:a:canonical:lxd:5.0.5
  • Canonical » Lxd » Version: 5.0.6
    cpe:2.3:a:canonical:lxd:5.0.6
  • Canonical » Lxd » Version: 5.0.7
    cpe:2.3:a:canonical:lxd:5.0.7
  • Canonical » Lxd » Version: 5.1
    cpe:2.3:a:canonical:lxd:5.1
  • Canonical » Lxd » Version: 5.10
    cpe:2.3:a:canonical:lxd:5.10
  • Canonical » Lxd » Version: 5.11
    cpe:2.3:a:canonical:lxd:5.11
  • Canonical » Lxd » Version: 5.12
    cpe:2.3:a:canonical:lxd:5.12
  • Canonical » Lxd » Version: 5.13
    cpe:2.3:a:canonical:lxd:5.13
  • Canonical » Lxd » Version: 5.14
    cpe:2.3:a:canonical:lxd:5.14
  • Canonical » Lxd » Version: 5.15
    cpe:2.3:a:canonical:lxd:5.15
  • Canonical » Lxd » Version: 5.16
    cpe:2.3:a:canonical:lxd:5.16
  • Canonical » Lxd » Version: 5.17
    cpe:2.3:a:canonical:lxd:5.17
  • Canonical » Lxd » Version: 5.18
    cpe:2.3:a:canonical:lxd:5.18
  • Canonical » Lxd » Version: 5.19
    cpe:2.3:a:canonical:lxd:5.19
  • Canonical » Lxd » Version: 5.2
    cpe:2.3:a:canonical:lxd:5.2
  • Canonical » Lxd » Version: 5.20
    cpe:2.3:a:canonical:lxd:5.20
  • Canonical » Lxd » Version: 5.21.0
    cpe:2.3:a:canonical:lxd:5.21.0
  • Canonical » Lxd » Version: 5.21.1
    cpe:2.3:a:canonical:lxd:5.21.1
  • Canonical » Lxd » Version: 5.21.2
    cpe:2.3:a:canonical:lxd:5.21.2
  • Canonical » Lxd » Version: 5.21.3
    cpe:2.3:a:canonical:lxd:5.21.3
  • Canonical » Lxd » Version: 5.21.4
    cpe:2.3:a:canonical:lxd:5.21.4
  • Canonical » Lxd » Version: 5.21.5
    cpe:2.3:a:canonical:lxd:5.21.5
  • Canonical » Lxd » Version: 5.3
    cpe:2.3:a:canonical:lxd:5.3
  • Canonical » Lxd » Version: 5.4
    cpe:2.3:a:canonical:lxd:5.4
  • Canonical » Lxd » Version: 5.5
    cpe:2.3:a:canonical:lxd:5.5
  • Canonical » Lxd » Version: 5.6
    cpe:2.3:a:canonical:lxd:5.6
  • Canonical » Lxd » Version: 5.7
    cpe:2.3:a:canonical:lxd:5.7
  • Canonical » Lxd » Version: 5.8
    cpe:2.3:a:canonical:lxd:5.8
  • Canonical » Lxd » Version: 5.9
    cpe:2.3:a:canonical:lxd:5.9
  • Canonical » Lxd » Version: 6.0
    cpe:2.3:a:canonical:lxd:6.0
  • Canonical » Lxd » Version: 6.1
    cpe:2.3:a:canonical:lxd:6.1
  • Canonical » Lxd » Version: 6.2
    cpe:2.3:a:canonical:lxd:6.2
  • Canonical » Lxd » Version: 6.3
    cpe:2.3:a:canonical:lxd:6.3
  • Canonical » Lxd » Version: 6.4
    cpe:2.3:a:canonical:lxd:6.4
  • Canonical » Lxd » Version: 6.5
    cpe:2.3:a:canonical:lxd:6.5
  • Canonical » Lxd » Version: 6.6
    cpe:2.3:a:canonical:lxd:6.6
  • Canonical » Lxd » Version: 6.7
    cpe:2.3:a:canonical:lxd:6.7
  • Canonical » Lxd » Version: 6.8
    cpe:2.3:a:canonical:lxd:6.8
  • Canonical » Lxd » Version: 6.9
    cpe:2.3:a:canonical:lxd:6.9


Products
Pricing
Contact Us

Shodan ® - All rights reserved