THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-63299 (CRITICAL 9.9) — An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreatio

[NVD] CVE-2026-63299 (CRITICAL 9.9) — An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreatio

lownvdPublished 2026-08-12

CVE-2026-63299 CVSS: 9.9 CRITICAL Published: 2026-08-12T20:17:47.830

An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, an

Indicators of compromise

CVE-2026-63299cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-63299