Authorization bypass in LXD cross-project cluster instance migration (CVE-2026-62420)

An authorization bypass vulnerability in LXD allows an authenticated attacker with project-level access to move an instance cross-project to a different cluster member via POST /1.0/instances/{name}, causing the destination node to skip all project restriction checks because the request is flagged as an internal cluster notification. This enables the attacker to introduce instances carrying dangerous configurations (such as raw.lxc hooks, security.privileged, or raw.qemu) into a restricted project and execute arbitrary commands as root on the host. Affected versions: - >= 5.0, <= 6.9 We recommend updating to: 5.0.8, 5.21.6, 6.10. CVSS 9.9 · our assessment: act_now Reference: https://github.com/canonical/lxd/security/advisories/GHSA-v9wr-9r7q-fh4g Details: https://vuln.today/cve/CVE-2026-62420