Skip to content
CVE PROGRAM SOURCE RECORD8.5 High

CVE-2026-63299

Storage volume cross-project move and snapshot restore bypass project disk limits

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
canonical

Description

An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil (Config == nil). An attacker can exploit these flaws to allocate storage resources that exceed the administrative limits configured for a project.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Canonical LXD

Default version status: unaffected

  • 5.0.0 to < 5.0.8affected
  • 5.21.0 to < 5.21.6affected
  • 6.0 to < 6.10affected

References