THREAT OPS › Threat News › [NVD] CVE-2026-63297 (CRITICAL 9.9) — An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction check
[NVD] CVE-2026-63297 (CRITICAL 9.9) — An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction check
CVE-2026-63297 CVSS: 9.9 CRITICAL Published: 2026-08-12T20:17:47.583
An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction checks before configuration merging is complete, creati
Indicators of compromise
- CVE-2026-63297cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-63297