Security readout for executives and security teams
Plain-English summary
A logged-in LXD user may move an instance into a restricted project while bypassing that project's security rules. The bypass requires a clustered LXD deployment, a cross-project migration, and placement on another cluster member. Successful abuse could introduce prohibited configurations and threaten confidentiality, integrity, and availability.
Executive priority
Treat as an urgent remediation for multi-tenant or delegated-administration LXD clusters. Prioritize systems where project restrictions form a security boundary and non-administrators can migrate instances. Exact fixed-version information is absent from the supplied bundle, so require confirmation against Canonical's advisory before closing remediation.
Technical view
During a cross-project instance migration using the LXD instances API, specifying migration, target project, and destination cluster member causes the destination request to be treated as an internal cluster notification. The destination then skips project restriction checks, creating an authorization bypass classified as CWE-863. The supplied CVSS 3.1 score is 9.9.
Likely exposure
Exposure is most likely where affected LXD versions run as a cluster, projects enforce security restrictions, and authenticated users can initiate cross-project migrations targeting another member. Standalone deployments or environments without this permission path appear less exposed, but the supplied sources do not provide a complete configuration matrix.
Exploitation context
Authentication and migration privileges are required, but no user interaction is needed and attack complexity is rated low. The supplied record is not in KEV, and no source provided here reports active exploitation. Public references include the vendor advisory and patch pull requests, which may help defenders understand the correction.
Researcher notes
The security-boundary failure occurs because an externally initiated operation becomes an internal cluster notification at the destination, suppressing authorization checks. Review both referenced pull requests for the complete correction. The supplied affected list names LXD 5.0.0, 5.21.0, and 6.0, but does not clarify affected ranges or fixed releases.
Mitigation direction
- Review Canonical's advisory and determine the vendor-supported fixed release for your LXD branch.
- Apply the vendor-supported update containing the referenced authorization-check corrections.
- Until updated, restrict cross-project migration permissions to trusted administrators.
- Limit access to LXD's API and monitor privileged migration activity.
Validation and detection
- Inventory LXD versions and identify clustered deployments using restricted projects.
- Confirm which users or roles can initiate cross-project instance migrations.
- Review migration records for cross-project moves targeting a different cluster member.
- Check destination projects for instances whose configurations violate current restrictions.
- Verify the installed update includes Canonical's referenced authorization-check changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-863: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-62420 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H3.16canonicalVulnerability scoring details
Base CVSS 3.1 score
9.9CriticalVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/canonical/lxd/security/advisories/GHSA-v9wr-9r7q-fh4gCVE reference, canonical · vdb-entry, vendor-advisory
- https://github.com/canonical/lxd/pull/18651CVE reference, canonical · patch
- https://github.com/canonical/lxd/pull/18605CVE reference, canonical · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Authorization
Incorrect Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.