An authorization bypass vulnerability (CWE-863) exists in Canonical LXD where project-level container isolation restrictions are not enforced if an instance configuration omits the security.idmap.isolated key. This allows an authenticated attacker to create or update an instance without setting this key, thereby bypassing security constraints intended to isolate container privileges within projects. The issue affects multiple specific versions of LXD, including exact versions 4.0.0, 5.0.0, 5.21.0, 6.0, and version ranges >=4.0.0 <4.0.12, >=5.0.0 <5.0.8, >=5.21.0 <5.21.6, and >=6.0 <6.10. There is no vendor advisory indicating a patch or fix at this time. The vulnerability is rated medium severity with a CVSS 3.1 score of 4.3.

An authenticated attacker can bypass project-level container isolation restrictions by exploiting this flaw, potentially undermining security policies that restrict container privileges. The vulnerability does not impact confidentiality or integrity directly but affects availability as indicated by the CVSS vector. This could lead to unauthorized container privilege escalation within a project environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should carefully review project and instance configurations to ensure the security.idmap.isolated key is explicitly set where required. Monitoring for unusual container creation or updates without this key may help detect attempts to exploit this vulnerability.