Security restriction bypass in LXD cross-project instance migration (CVE-2026-63300)

The `instancePostMigration` function in LXD fails to validate an instance's configuration against the target project's enforced restrictions when moving an instance between projects. An authenticated attacker with `can_create_instances` permission on a restricted project can create a privileged or otherwise disallowed instance in an unrestricted project and migrate it into the restricted one, bypassing all project-level security controls. This can result in arbitrary command execution on the host as root. Affected versions: - >= 5.0, <= 6.9 We recommend updating to: 5.0.8, 5.21.6, 6.10. CVSS 9.9 · our assessment: act_now Reference: https://github.com/canonical/lxd/security/advisories/GHSA-5g5r-wh97-qcq2 Details: https://vuln.today/cve/CVE-2026-63300