THREATOPS
THREAT OPS › Threat News › [NVD] CVE-2026-62420 (CRITICAL 9.9) — An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/{name} with migration

[NVD] CVE-2026-62420 (CRITICAL 9.9) — An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/{name} with migration

lownvdPublished 2026-08-12

CVE-2026-62420 CVSS: 9.9 CRITICAL Published: 2026-08-12T20:17:46.897

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/{name} with migration: true, project: <target>, and target: <member>, t

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-62420