What is the CVSS score of EUVD-2026-57515?

EUVD-2026-57515 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of LXD are affected by EUVD-2026-57515?

Canonical LXD contains a critical authorization bypass affecting authenticated users with instance-migration privileges, allowing them to circumvent security boundaries when moving containers between…. A patch is available.

How to fix or mitigate EUVD-2026-57515?

Within 24 hours: Audit LXD deployments to identify all users and service accounts with instance-migration privileges. Within 7 days: Restrict instance-migration privileges to minimal trusted administrative accounts, disable inter-project instance migrations if not operationally required, enable comprehensive audit logging of all migration operations, and document that no vendor-released patch is currently available. Within 30 days: Monitor Canonical security advisories for patch availability; when released, prioritize validation and immediate deployment to all affected LXD instances.

LXD EUVD-2026-57515

| CVE-2026-63296 CRITICAL

Incorrect Authorization (CWE-863)

2026-08-12 canonical

Authentication Bypass Lxd Suse

9.9

CVSS 3.1 · Vendor: canonical

Severity by source

Vendor (canonical) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Authenticated migration privilege gives PR:L; network API and simple override give AV:N/AC:L; escaping project restrictions to host/cross-tenant justifies S:C with full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Primary rating from Vendor (canonical).

CVSS VectorVendor: canonical

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 12, 2026 - 21:17 EUVD

Analysis Generated

Aug 12, 2026 - 20:23 vuln.today

CVE Published

Aug 12, 2026 - 19:27 cve.org

CRITICAL 9.9

DescriptionCVE.org

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without validating the new configuration against the target project's enforced restrictions. An attacker can exploit this flaw to move instances with disallowed high-privilege configurations into restricted projects, bypassing security controls.

AnalysisAI

Authorization bypass in Canonical LXD lets an authenticated user with instance-migration privileges smuggle high-privilege instance configurations into restricted projects. When an instance is migrated to a target project, LXD applies caller-supplied configuration overrides without re-validating them against the destination project's enforced restrictions, so security controls such as privileged-container or device limits can be defeated. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate to LXD API with migration rights

Delivery

Craft instance with high-privilege config

Exploit

Migrate to restricted project with config overrides

Execution

Restriction check bypassed on target project

Persist

Instance runs with disallowed privileges

Impact

Break tenant isolation / reach host

Access

Authenticate to LXD API with migration rights

Delivery

Craft instance with high-privilege config

Exploit

Migrate to restricted project with config overrides

Execution

Restriction check bypassed on target project

Persist

Instance runs with disallowed privileges

Impact

Break tenant isolation / reach host

Vulnerability AssessmentAI

Exploitation	The attacker must be an authenticated LXD user (PR:L) who holds permission to migrate/move an instance into a target project - this is the concrete prerequisite. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine high-priority issue rather than an inflated high-CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An authenticated LXD user who is allowed to migrate instances but confined to a restricted project prepares an instance carrying a privileged/high-privilege configuration and migrates it into the restricted project, supplying config overrides during the move. Because LXD does not re-validate those overrides against the project's restrictions, the instance lands with privileges the project should forbid, giving the attacker a foothold to break tenant isolation or reach the host. …
Remediation	Patch available per vendor advisory: upgrade LXD to the fixed release named in Canonical's GHSA-gcr9-5q6r-w625 (https://github.com/canonical/lxd/security/advisories/GHSA-gcr9-5q6r-w625); the exact fixed version is not included in the provided intelligence, so verify it directly from that advisory before scheduling the upgrade. … Detailed patch versions, workarounds, and compensating controls in full report.