# CVE-2026-63300: An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an…

Source: https://junglewise.ai/threats/cve-2026-63300-an-improper-validation-vulnerability-in-the-instancepostmigration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-12  
License: CC BY 4.0 with a link back

CVE-2026-63300 · Severity: critical · CVSS 9.9 · Published 2026-08-12

An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker with can_create_instances permissions on a restricted project to bypass project-level security restrictions. When migrating an instance between projects, LXD fails to validate the instance's configuration against the target project's enforced restrictions (such as restricted.containers.lowlevel, restricted.devices.*, and restricted.networks.access). An attacker can exploit this by creating a disallowed or high-privilege instance in an unrestricted project and subsequently moving it into the restricted project.

Technologies: [Canonical LXD](https://junglewise.ai/threats/technologies/lxd). Vendors: [Canonical](https://junglewise.ai/threats/vendors/canonical).

## Quick answers

**Is CVE-2026-63300 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63300 being exploited in the wild.

**How severe is CVE-2026-63300?** Critical severity, with a CVSS score of 9.9, published 12 August 2026.

**Which products and versions are affected?** Canonical LXD. The advisory does not name versions.

**Is there a fix for CVE-2026-63300?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-63300?** Check whether you run Canonical LXD. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Canonical LXD

## Related threats

- [LXD project restriction bypass in instance copy](https://junglewise.ai/threats/lxd-has-project-restriction-bypass-in-instance-copy-across-projects-48d466e0)
- [Canonical LXD improper certificate validation in HTTPS listener](https://junglewise.ai/threats/cve-2026-112816-improper-certificate-validation-in-the-https-listener-in)
- [Canonical LXD custom storage volume authorization bypass](https://junglewise.ai/threats/cve-2026-97335-incorrect-authorization-in-the-custom-storage-volume-creation)
- [Canonical LXD arbitrary file write via symlink in migration stream](https://junglewise.ai/threats/cve-2026-87799-improper-link-resolution-in-the-migration-receive-path-in)
- [Canonical LXD improper symlink resolution in recursive file pull](https://junglewise.ai/threats/cve-2026-87798-improper-link-resolution-in-the-recursive-file-pull-feature-of)