CVE catalog

CVE-2026-63295

An authorization bypass vulnerability in LXD allows an…

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges (such as enforcing restricted.containers.privilege=isolated), LXD fails to enforce the requirement if an instance configuration omits the security.idmap.isolated key. An attacker can exploit this flaw by creating or updating an instance without explicitly setting security.idmap.isolated, bypassing the target project's security constraints.

Severity: Medium · CVSS 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Published: Aug 12, 2026, 8:17:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.35% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie-security	lxd	`5.0.2+git20231211.1364ae4-9+deb13u7`	Affected	[CVE-2026-63295]
Debiantrixie	lxd	Not reported	AffectedDistribution reports no fix	[CVE-2026-63295]
Debiantrixie	lxd	`5.0.2+git20231211.1364ae4-9+deb13u7`	Affected	[CVE-2026-63295]
Ubuntupro	lxd	`2.18-0ubuntu6`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`2.19-0ubuntu1`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`2.20-0ubuntu3`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`2.20-0ubuntu4`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`2.21-0ubuntu1`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`2.21-0ubuntu2`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`2.21-0ubuntu3`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`2.21-0ubuntu4`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`3.0.0-0ubuntu1`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC

Showing 12 observations. All 33 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debianbookworm	lxd	Not reported	AffectedDistribution reports no fix	[CVE-2026-63295]
Debianbookworm	lxd	`5.0.2-5+deb12u6`	Affected	[CVE-2026-63295]
Debianbookworm-security	lxd	`5.0.2-5+deb12u6`	Affected	[CVE-2026-63295]
Debiantrixie	lxd	Not reported	AffectedDistribution reports no fix	[CVE-2026-63295]
Debiantrixie	lxd	`5.0.2+git20231211.1364ae4-9+deb13u7`	Affected	[CVE-2026-63295]
Debiantrixie-security	lxd	`5.0.2+git20231211.1364ae4-9+deb13u7`	Affected	[CVE-2026-63295]
Ubuntu20.04	lxd	`1:0.10`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntu20.04	lxd	`1:0.7`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntu20.04	lxd	`1:0.8`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntu20.04	lxd	`1:0.9`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`2.18-0ubuntu6`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`2.19-0ubuntu1`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`2.20-0ubuntu3`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`2.20-0ubuntu4`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`2.21-0ubuntu1`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`2.21-0ubuntu2`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`2.21-0ubuntu3`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`2.21-0ubuntu4`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`3.0.0-0ubuntu1`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`3.0.0-0ubuntu2`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`3.0.0-0ubuntu3`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`3.0.0-0ubuntu4`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`3.0.0~beta2-0ubuntu3`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`3.0.0~beta3-0ubuntu3`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`3.0.0~beta5-0ubuntu2`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`3.0.0~beta7-0ubuntu1`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`3.0.1-0ubuntu1~18.04.1`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`3.0.2-0ubuntu1~18.04.1`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`3.0.3-0ubuntu1~18.04.1`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`3.0.3-0ubuntu1~18.04.2`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`3.0.3-0ubuntu1~18.04.2+esm1`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`3.0.3-0ubuntu1~18.04.2+esm2`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC
Ubuntupro	lxd	`3.0.3-0ubuntu1~18.04.2+esm3`	Affected	[UBUNTU-CVE-2026-63295]Aug 19, 2026, 11:06:33 AM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "lxd",
      "status": "vulnerable",
      "release": "trixie",
      "version": "5.0.2+git20231211.1364ae4-9+deb13u7"
    },
    {
      "name": "lxd",
      "status": "vulnerable",
      "release": "trixie-security",
      "version": "5.0.2+git20231211.1364ae4-9+deb13u7"
    },
    {
      "name": "lxd",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "5.0.2-5+deb12u6"
    },
    {
      "name": "lxd",
      "status": "vulnerable",
      "release": "bookworm-security",
      "version": "5.0.2-5+deb12u6"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "lxd",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "lxd",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "end-of-life",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "lxd",
      "ranges": [
        {
          "fixed": "6.10",
          "introduced": "6.0",
          "last_affected": "",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63295",
      "fixed_version": "6.10",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2026-63295",
      "provider_updated_at": "2026-10-24T16:10:00.153"
    },
    {
      "name": "lxd",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "2.18-0ubuntu6",
        "2.19-0ubuntu1",
        "2.20-0ubuntu3",
        "2.20-0ubuntu4",
        "2.21-0ubuntu1",
        "2.21-0ubuntu2",
        "2.21-0ubuntu3",
        "2.21-0ubuntu4",
        "3.0.0~beta2-0ubuntu3",
        "3.0.0~beta3-0ubuntu3",
        "3.0.0~beta5-0ubuntu2",
        "3.0.0~beta7-0ubuntu1",
        "3.0.0-0ubuntu1",
        "3.0.0-0ubuntu2",
        "3.0.0-0ubuntu3",
        "3.0.0-0ubuntu4",
        "3.0.1-0ubuntu1~18.04.1",
        "3.0.2-0ubuntu1~18.04.1",
        "3.0.3-0ubuntu1~18.04.1",
        "3.0.3-0ubuntu1~18.04.2",
        "3.0.3-0ubuntu1~18.04.2+esm1",
        "3.0.3-0ubuntu1~18.04.2+esm2",
        "3.0.3-0ubuntu1~18.04.2+esm3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-63295",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-63295",
      "provider_updated_at": "2026-08-19T11:06:33Z"
    },
    {
      "name": "lxd",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "1:0.7",
        "1:0.8",
        "1:0.9",
        "1:0.10"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-63295",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-63295",
      "provider_updated_at": "2026-08-19T11:06:33Z"
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[lxd]Unknown
Details (4)
- 5.0.2-5+deb12u6 · amd64 · bookworm
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
- 5.0.2-5+deb12u6 · arm64 · bookworm
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
- 5.0.2-5+deb12u6 · amd64 · bookworm-security
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
- 5.0.2-5+deb12u6 · arm64 · bookworm-security
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
[lxd-agent]Unknown
Source package: [lxd]
Details (4)
- 5.0.2-5+deb12u6 · amd64 · bookworm
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
- 5.0.2-5+deb12u6 · arm64 · bookworm
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
- 5.0.2-5+deb12u6 · amd64 · bookworm-security
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
- 5.0.2-5+deb12u6 · arm64 · bookworm-security
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
[lxd-client]Unknown
Source package: [lxd]
Details (4)
- 5.0.2-5+deb12u6 · amd64 · bookworm
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
- 5.0.2-5+deb12u6 · arm64 · bookworm
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
- 5.0.2-5+deb12u6 · amd64 · bookworm-security
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
- 5.0.2-5+deb12u6 · arm64 · bookworm-security
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
[lxd-migrate]Unknown
Source package: [lxd]
Details (4)
- 5.0.2-5+deb12u6 · amd64 · bookworm
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
- 5.0.2-5+deb12u6 · arm64 · bookworm
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
- 5.0.2-5+deb12u6 · amd64 · bookworm-security
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
- 5.0.2-5+deb12u6 · arm64 · bookworm-security
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
[lxd-tools]Unknown
Source package: [lxd]
Details (4)
- 5.0.2-5+deb12u6 · amd64 · bookworm
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
- 5.0.2-5+deb12u6 · arm64 · bookworm
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
- 5.0.2-5+deb12u6 · amd64 · bookworm-security
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
- 5.0.2-5+deb12u6 · arm64 · bookworm-security
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12

[Debian 13 (Trixie)]

[golang-github-canonical-lxd-dev]Unknown
Source package: [lxd]
Details (4)
- 5.0.2+git20231211.1364ae4-9+deb13u7 · all · trixie
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · all · trixie
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · all · trixie-security
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · all · trixie-security
  Affected
  nvd · lxd · debian · 13
[lxd]Unknown
Details (4)
- 5.0.2+git20231211.1364ae4-9+deb13u7 · amd64 · trixie
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · arm64 · trixie
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · amd64 · trixie-security
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · arm64 · trixie-security
  Affected
  nvd · lxd · debian · 13
[lxd-agent]Unknown
Source package: [lxd]
Details (4)
- 5.0.2+git20231211.1364ae4-9+deb13u7 · amd64 · trixie
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · arm64 · trixie
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · amd64 · trixie-security
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · arm64 · trixie-security
  Affected
  nvd · lxd · debian · 13
[lxd-client]Unknown
Source package: [lxd]
Details (4)
- 5.0.2+git20231211.1364ae4-9+deb13u7 · amd64 · trixie
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · arm64 · trixie
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · amd64 · trixie-security
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · arm64 · trixie-security
  Affected
  nvd · lxd · debian · 13
[lxd-migrate]Unknown
Source package: [lxd]
Details (4)
- 5.0.2+git20231211.1364ae4-9+deb13u7 · amd64 · trixie
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · arm64 · trixie
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · amd64 · trixie-security
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · arm64 · trixie-security
  Affected
  nvd · lxd · debian · 13
[lxd-tools]Unknown
Source package: [lxd]
Details (4)
- 5.0.2+git20231211.1364ae4-9+deb13u7 · amd64 · trixie
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · arm64 · trixie
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · amd64 · trixie-security
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · arm64 · trixie-security
  Affected
  nvd · lxd · debian · 13

Observed: Oct 27, 2026, 7:10:10 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]