CVE-2026-63295

Name	CVE-2026-63295
Description	An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges (such as enforcing restricted.containers.privilege=isolated), LXD fails to enforce the requirement if an instance configuration omits the security.idmap.isolated key. An attacker can exploit this flaw by creating or updating an instance without explicitly setting security.idmap.isolated, bypassing the target project's security constraints.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
lxd (PTS)	bookworm, bookworm (security)	5.0.2-5+deb12u6	vulnerable
	trixie (security), trixie	5.0.2+git20231211.1364ae4-9+deb13u7	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
lxd	source	bookworm	(unfixed)	end-of-life
lxd	source	(unstable)	(unfixed)

[bookworm] - lxd <end-of-life> (EOL in bookworm LTS)
https://github.com/canonical/lxd/security/advisories/GHSA-7vp9-3vmp-c5jm