CVE-2026-63299: CWE-770 Allocation of Resources Without Limits or Throttling in Canonical LXD
An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil (Config == nil). An attacker can exploit these flaws to allocate storage resources that exceed the administrative limits configured for a project.
AI Analysis
Technical Summary
This vulnerability in Canonical LXD involves improper enforcement of resource limits at the project level. Specifically, the storagePoolVolumeTypePostMove function does not perform the limits.AllowVolumeCreation check when moving volumes across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check if the configuration is nil. These authorization bypasses allow authenticated users to allocate storage resources exceeding the limits set by administrators. The issue affects LXD versions 5.0.0, 5.21.0, 6.0, and ranges >=5.0.0 <5.0.8, >=5.21.0 <5.21.6, and >=6.0 <6.10. The CVSS 3.1 score is 8.5, indicating high impact on confidentiality, integrity, and availability. The vendor provides patches and manages remediation for the cloud-hosted service.
Potential Impact
An authenticated user can bypass project-level disk and volume limits, potentially leading to resource exhaustion or denial of service by allocating more storage than allowed. This compromises the intended resource governance and can affect system stability and availability. The vulnerability impacts confidentiality, integrity, and availability as per the CVSS vector.
Mitigation Recommendations
The vendor manages remediation for this cloud-hosted service and has patches available. Users of affected LXD versions should apply the official patches or updates provided by Canonical. Check the vendor advisory for the latest remediation guidance. No indication exists that no action is required or that the issue is already mitigated without patching.
CVE-2026-63299: CWE-770 Allocation of Resources Without Limits or Throttling in Canonical LXD
Description
An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil (Config == nil). An attacker can exploit these flaws to allocate storage resources that exceed the administrative limits configured for a project.
CVSS v3.1
Score 8.5high
Affected software
pkg:github/LXDRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Canonical LXD involves improper enforcement of resource limits at the project level. Specifically, the storagePoolVolumeTypePostMove function does not perform the limits.AllowVolumeCreation check when moving volumes across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check if the configuration is nil. These authorization bypasses allow authenticated users to allocate storage resources exceeding the limits set by administrators. The issue affects LXD versions 5.0.0, 5.21.0, 6.0, and ranges >=5.0.0 <5.0.8, >=5.21.0 <5.21.6, and >=6.0 <6.10. The CVSS 3.1 score is 8.5, indicating high impact on confidentiality, integrity, and availability. The vendor provides patches and manages remediation for the cloud-hosted service.
Potential Impact
An authenticated user can bypass project-level disk and volume limits, potentially leading to resource exhaustion or denial of service by allocating more storage than allowed. This compromises the intended resource governance and can affect system stability and availability. The vulnerability impacts confidentiality, integrity, and availability as per the CVSS vector.
Mitigation Recommendations
The vendor manages remediation for this cloud-hosted service and has patches available. Users of affected LXD versions should apply the official patches or updates provided by Canonical. Check the vendor advisory for the latest remediation guidance. No indication exists that no action is required or that the issue is already mitigated without patching.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- canonical
- Date Reserved
- 2026-07-16T10:01:05.653Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Is Cloud Service
- true
Threat ID: 6a7cc907bf8831d539077101
Added to database: 08/12/2026, 19:27:03 UTC
Last enriched: 08/12/2026, 19:56:38 UTC
Last updated: 08/12/2026, 20:01:38 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.