# CVE-2026-63297: An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated…

Source: https://junglewise.ai/threats/cve-2026-63297-an-authorization-bypass-vulnerability-in-lxd-due-to-a-timing-flaw  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-12  
License: CC BY 4.0 with a link back

CVE-2026-63297 · Severity: critical · CVSS 9.9 · Published 2026-08-12

An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction checks before configuration merging is complete, creating a time-of-check to time-of-use (TOCTOU) condition. An attacker can exploit this flaw to copy instances with disallowed high-privilege configurations into restricted projects, bypassing security controls.

Technologies: [Canonical LXD](https://junglewise.ai/threats/technologies/lxd). Vendors: [Canonical](https://junglewise.ai/threats/vendors/canonical).

## Quick answers

**Is CVE-2026-63297 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63297 being exploited in the wild.

**How severe is CVE-2026-63297?** Critical severity, with a CVSS score of 9.9, published 12 August 2026.

**Which products and versions are affected?** Canonical LXD. The advisory does not name versions.

**Is there a fix for CVE-2026-63297?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-63297?** Check whether you run Canonical LXD. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Canonical LXD

## Related threats

- [LXD project restriction bypass in instance copy](https://junglewise.ai/threats/lxd-has-project-restriction-bypass-in-instance-copy-across-projects-48d466e0)
- [Canonical LXD improper certificate validation in HTTPS listener](https://junglewise.ai/threats/cve-2026-112816-improper-certificate-validation-in-the-https-listener-in)
- [Canonical LXD custom storage volume authorization bypass](https://junglewise.ai/threats/cve-2026-97335-incorrect-authorization-in-the-custom-storage-volume-creation)
- [Canonical LXD arbitrary file write via symlink in migration stream](https://junglewise.ai/threats/cve-2026-87799-improper-link-resolution-in-the-migration-receive-path-in)
- [Canonical LXD improper symlink resolution in recursive file pull](https://junglewise.ai/threats/cve-2026-87798-improper-link-resolution-in-the-recursive-file-pull-feature-of)