Canonical LXD contains a critical authorization flaw that allows authenticated attackers to bypass project security restrictions during cross-project instance migrations.

This is an incorrect authorization vulnerability (CWE-863) where the destination node in a cluster incorrectly assumes that incoming migration requests are internal cluster notifications, thereby bypassing all security restriction checks. The attack requires an authenticated user with permission to initiate migrations.

By exploiting this flaw, an attacker can move arbitrary instance configurations into restricted projects, effectively neutralizing the security boundaries of the LXD cluster. Given the CVSS score of 9.9, this allows for total technical impact, including potential privilege escalation and unauthorized access to restricted container resources.

Immediate Action: Update all nodes in the LXD cluster to version 5.0.8, 5.21.6, or 6.10 or later to ensure correct authorization validation.

Proactive Monitoring: Review cluster migration traffic and access logs for requests that appear to be bypassing intended project-level security policies.

Compensating Controls: Ensure that the cluster network is isolated and that only authorized nodes can communicate with the LXD API to prevent unauthorized internal-style traffic.

Public Exploit Available: Unknown.

This vulnerability is critical due to its ability to bypass all project-level security checks during cluster migrations. It is imperative that all cluster members are patched simultaneously to prevent an attacker from targeting unpatched nodes within the cluster.