Incorrect authorization in LXD - CVE-2026-62420
Published: August 1, 2026
Vulnerability details
The vulnerability allows a remote user to execute arbitrary commands as root on the host.
The vulnerability exists due to incorrect authorization in cross-project cluster migration handling in POST /1.0/instances/{name} when processing a cross-project instance move to a different cluster member with migration enabled and the cluster notification flag set. A remote user can move an instance with restricted configuration keys into a restricted target project to execute arbitrary commands as root on the host.
Exploitation requires project-level access that allows instance creation in an unrestricted project and can_create_instances permission on the restricted target project. No start-time restriction re-validation occurs after the move.