Canonical LXD contains a critical authorization bypass vulnerability that allows authenticated attackers to circumvent project security restrictions during instance migration.

This is an incorrect authorization flaw (CWE-863) where the LXD migration process fails to validate instance configuration overrides against target project restrictions. The vulnerability requires an authenticated attacker to perform the migration.

Successful exploitation allows an attacker to introduce high-privilege or otherwise disallowed instance configurations into environments that should be restricted. Given the CVSS score of 9.9, this vulnerability poses a severe risk to multi-tenant isolation, potentially enabling lateral movement or full container escape scenarios within the LXD cluster.

Immediate Action: Upgrade to LXD version 5.0.8, 5.21.6, 6.10, or later versions immediately to apply the necessary authorization checks.

Proactive Monitoring: Review LXD audit logs for suspicious instance migration patterns or unexpected configuration changes in restricted projects.

Compensating Controls: Restrict administrative access to the LXD API to trusted users only, as the vulnerability requires existing authentication to exploit.

Public Exploit Available: Unknown.

This vulnerability represents a significant breakdown in security policy enforcement within the LXD environment. Organizations should prioritize updating their LXD instances to the identified patched versions to prevent unauthorized configuration overrides and maintain project isolation.