Cloudanix VulnDB

CVE-2026-62420

Critical · 9.9

CVSS

9.9

EPSS

0.5%

Published

Aug 12, 2026

CISA due date

—

The record

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/{name} with migration: true, project: <target>, and target: <member>, the destination node skips all project restriction checks because the request arrives as an internal cluster notification. An attacker can exploit this to introduce disallowed instance configurations into a restricted project.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities