THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-63300 (CRITICAL 9.9) — An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker with can_create_instances permissions on a restricted project to bypass project-level security restrictions. When migrating an instance betwe

[NVD] CVE-2026-63300 (CRITICAL 9.9) — An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker with can_create_instances permissions on a restricted project to bypass project-level security restrictions. When migrating an instance betwe

lownvdPublished 2026-08-12

CVE-2026-63300 CVSS: 9.9 CRITICAL Published: 2026-08-12T20:17:47.953

An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker with can_create_instances permissions on a restricted project to bypass project-level security restrictions. When migrating an instance between projects, LXD fails to validate the instance's

Indicators of compromise

CVE-2026-63300cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-63300