A critical authorization bypass vulnerability in Canonical LXD allows authenticated attackers to circumvent project-level security policies, posing a high risk to container isolation.

The instancePostMigration function fails to enforce security restrictions during instance migration. An attacker with low-level project creation privileges can move high-privilege instances into restricted projects, effectively bypassing intended security boundaries.

Successful exploitation allows an attacker to execute arbitrary code within containers or environments they should be restricted from accessing. Given the CVSS score of 9.9, this vulnerability represents a severe threat to multi-tenant environments, potentially leading to total system compromise, unauthorized data access, and the invalidation of security isolation policies.

Immediate Action: Upgrade LXD to version 5.0.8, 5.21.6, 6.10, or later immediately to apply the necessary authorization checks.

Proactive Monitoring: Review LXD audit logs for unusual migration activities or unexpected changes in instance security profiles within restricted projects.

Compensating Controls: Restrict the ability to create or migrate instances to trusted users only, and ensure project-level configurations are strictly audited until the patch is applied.

Public Exploit Available: Unknown

This vulnerability is critical due to its ability to break core security boundaries in LXD. Administrators must prioritize the deployment of the provided patches to all affected nodes to prevent unauthorized privilege escalation and maintain container integrity.