Improper access control in LXD - CVE-2026-63295
Published: August 1, 2026
Vulnerability identifier: #VU140677
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-63295
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Affected software:
LXD
LXD
Detailed vulnerability description
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper access control in the project restriction enforcement for restricted.containers.privilege and security.idmap.isolated when creating or updating containers and profiles with the security.idmap.isolated key omitted. A remote user can omit the security.idmap.isolated setting to obtain a non-isolated container and cause a denial of service.
The issue affects restriction checks routed through checkRestrictions, and the omitted key is treated by the runtime as the default non-isolated state.
How to mitigate CVE-2026-63295
Install security update from vendor's website.