This vulnerability exists in the instancePostMigration function in lxd/instance_post.go of LXD. An attacker with can_create_instances permissions on a restricted project can exploit the lack of validation of instance configurations against the target project's enforced restrictions (such as restricted.containers.lowlevel, restricted.devices.*, and restricted.networks.access). By first creating a disallowed or high-privilege instance in an unrestricted project and then migrating it into a restricted project, the attacker bypasses project-level security controls.

Successful exploitation allows an attacker with limited permissions to escalate privileges within restricted projects by deploying instances that violate the intended security policies. This can lead to full confidentiality, integrity, and availability compromise of the affected LXD environment, as indicated by the CVSS score of 9.9 (critical).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict can_create_instances permissions carefully and monitor migrations between projects to detect unauthorized instance movements.