CVE-2026-63299

This CVE exposes a fundamental fragility in LXD's storage limit enforcement: the system relies on developers manually inserting authorization checks at the correct code paths, rather than enforcing limits through an automatic mechanism. The two documented bypasses — cross-project volume moves and nil-config snapshot restores — both involve adding or modifying storage resources in ways that clearly require limit enforcement, yet the AllowVolumeCreation and AllowVolumeUpdate checks are simply absent from these paths. This isn't a one-off developer error; it's a structural pattern where the implicit assumption 'enforce limits wherever you touch storage' degrades under maintenance pressure, code churn, and team turnover. The CVSS 9.9 versus EPSS 0.00283 gap is significant but requires careful interpretation. The high severity reflects worst-case multi-tenant deployments where project storage limits are the mechanism preventing resource contention. The low EPSS doesn't mean exploitation is rare — it likely reflects detection bias. Storage consumption is silent; there's no alerting when a project quietly accumulates headroom beyond its configured limit. Sophisticated attackers would exploit this quietly, staying below thresholds that trigger investigation. The EPSS measures caught exploitation, not successful exploitation. For defenders: first, audit your git history. Look for commits adding cross-project operations or snapshot logic that don't invoke AllowVolumeCreation or AllowVolumeUpdate — these are the highest-probability locations for similar gaps. Second, implement monitoring: track storage consumption velocity per project and alert on consumption that approaches or exceeds configured limits, regardless of how the data got there. Third, assume this isn't isolated — if enforcement depends on manual annotation, the attack surface is every storage operation path that wasn't reviewed. Treat these two bypasses as documented examples of a systematic enforcement failure, not as isolated bugs. The fix isn't just adding the two missing checks; it's determining whether your development process can prevent the next missing check from shipping. If storage operations can be added without security review, more silent failures likely exist.

Reviewed through automated stages and approved by a human before publication.