Fluid Attacks Database

Description

An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil (Config == nil). An attacker can exploit these flaws to allocate storage resources that exceed the administrative limits configured for a project.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version
debian 12	lxd	=5.0.2+git20231211.1364ae4-1 \|\| =5.0.2+git20231211.1364ae4-2 \|\| =5.0.2+git20231211.1364ae4-3 \|\| =5.0.2+git20231211.1364ae4-4 \|\| =5.0.2+git20231211.1364ae4-5 \|\| =5.0.2+git20231211.1364ae4-6 \|\| =5.0.2+git20231211.1364ae4-7 \|\| =5.0.2+git20231211.1364ae4-8 \|\| =5.0.2+git20231211.1364ae4-9 \|\| =5.0.2-5 \|\| =5.0.2-5+deb12u1 \|\| =5.0.2-5+deb12u2 \|\| =5.0.2-5+deb12u3 \|\| =5.0.2-5+deb12u4 \|\| =5.0.2-5+deb12u5 \|\| =5.0.2-5+deb12u6 \|\| =5.0.2-6
debian 13	lxd	=5.0.2+git20231211.1364ae4-9 \|\| =5.0.2+git20231211.1364ae4-9+deb13u1 \|\| =5.0.2+git20231211.1364ae4-9+deb13u2 \|\| =5.0.2+git20231211.1364ae4-9+deb13u3 \|\| =5.0.2+git20231211.1364ae4-9+deb13u4 \|\| =5.0.2+git20231211.1364ae4-9+deb13u5 \|\| =5.0.2+git20231211.1364ae4-9+deb13u6 \|\| =5.0.2+git20231211.1364ae4-9+deb13u7

Aliases

1. CVE-2026-632992. NVD-2026-632993. OSV-DEBIAN-2026-632994. OSV-2026-632995. SECURITY-TRACKER-CVE-2026-63299

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.