CVE-2026-63299 — Storage volume cross-project move and snapshot restore bypass project disk limits
An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits d…
Published: 2026-08-12 · CVSS: 8.5 · CVSS 3.1
An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil (Config == nil). An attacker can exploit these flaws to allocate storage resources that exceed the administrative limits configured for a project.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7