CVE-2026-63296

The CVSS 9.9 score attached to CVE-2026-63296 demands scrutiny. Yes, this vulnerability allows an authenticated attacker to escape project isolation during instance migration — moving high-privilege instances into constrained projects that should deny them. The impact is real for multi-tenant LXD deployments. But the EPSS of 0.00246 tells you something the severity rating doesn't: mass exploitation is unlikely. This isn't a commodity vulnerability — it requires specific knowledge of a deployment's project topology and legitimate credentials to initiate migration. You're looking at targeted attack territory, not opportunistic scanning. The root cause is more architectural than a single missed validation check. LXD validates instance configuration against project constraints at creation time, but during migration it treats the source configuration as already validated, accepting overrides without re-evaluating them against the target project's restrictions. The migration path was designed under an implicit assumption that validated configurations remain valid across project boundaries — an assumption that breaks once project isolation is hardened retroactively. True remediation likely required treating migration as a second-class creation event rather than a simple state transfer: re-evaluating instance configuration against target project constraints at migration time, not just trusting the source. When assessing your exposure, confirm whether the patch implements genuine re-validation or merely adds a permission check that could be bypassed through alternative code paths. Audit your own LXD deployments for similar gaps: cross-project transitions where configuration is transferred without re-evaluation, API endpoints accepting project-scoped resources from one context and applying them in another, or daemon-to-daemon channels that predate project isolation. The vulnerability patched here is one hole in a sediment layer — migration-adjacent code that survived multiple hardening cycles because it worked correctly and nobody touched it. There are likely others. Focus logging and alerting on project boundary violations, particularly migration operations that result in privilege escalation within the target project — that's the visibility gap that determines whether an exploited vulnerability becomes a detected incident.

Reviewed through automated stages and approved by a human before publication.