---
id: CVE-2026-63299
title: >-
  An authorization bypass vulnerability in LXD allows an authenticated user to
  bypass project-level disk and volume limits
summary: >-
  An authorization bypass vulnerability in LXD allows an authenticated user to
  bypass project-level disk and volume limits. Two related code paths fail to
  verify resource limits during volume operations: the
  storagePoolVolumeTypePostMove f…
severity: critical
cvss: 9.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-770
vendor: canonical
product: lxd
affected:
  - 'lxd >= 5.0.0, < 5.0.8'
  - 'lxd >= 5.1, < 5.21.6'
  - 'lxd >= 6.0, < 6.10'
patched:
  - lxd 6.10
published: '2026-08-12'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T15:26:06.753'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63299'
references:
  - url: 'https://github.com/canonical/lxd/security/advisories/GHSA-5h78-p252-989h'
    label: security@ubuntu.com
tags:
  - nvd
epss: 0.00398
epssPercentile: 0.33818
ingestedAt: '2026-09-11T17:50:33.511Z'
---

## Overview

An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil (Config == nil). An attacker can exploit these flaws to allocate storage resources that exceed the administrative limits configured for a project.

## Affected

- `lxd >= 5.0.0, < 5.0.8`
- `lxd >= 5.1, < 5.21.6`
- `lxd >= 6.0, < 6.10`

## Remediation

Upgrade past the affected range:

- `lxd 6.10`