CVE-2026-62420

{
  "id": "CVE-2026-62420",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-12T20:17:46.897",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/{name} with migration: true, project: <target>, and target: <member>, the destination node skips all project restriction checks because the request arrives as an internal cluster notification. An attacker can exploit this to introduce disallowed instance configurations into a restricted project."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de omisión de autorización en LXD permite a un atacante autenticado omitir las restricciones de seguridad del proyecto de destino durante las migraciones de instancias entre proyectos. Al mover una instancia entre proyectos a un miembro diferente del clúster a través de POST /1.0/instances/{name} con migration: true, project: [target] y target: [member], el nodo de destino omite todas las comprobaciones de restricción del proyecto porque la solicitud llega como una notificación interna del clúster. Un atacante puede explotar esto para introducir configuraciones de instancia no permitidas en un proyecto restringido."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Canonical",
          "product": "LXD",
          "defaultStatus": "unaffected",
          "packageName": "LXD",
          "platforms": [
            "Linux"
          ],
          "repo": "https://github.com/canonical/lxd",
          "versions": [
            {
              "version": "5.0.0",
              "lessThan": "5.0.8",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "5.21.0",
              "lessThan": "5.21.6",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "6.0",
              "lessThan": "6.10",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-12T19:26:54.388067Z",
          "id": "CVE-2026-62420",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.0.0",
              "versionEndExcluding": "5.0.8",
              "matchCriteriaId": "59D070D6-84D2-400E-8260-EA52E5C60D37"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.1",
              "versionEndExcluding": "5.21.6",
              "matchCriteriaId": "575036D1-2B55-4043-B94A-1584E3F2DA37"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.0",
              "versionEndExcluding": "6.10",
              "matchCriteriaId": "374F5622-1D8F-4EF9-97E6-736C8220623B"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/canonical/lxd/pull/18605",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/canonical/lxd/pull/18651",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/canonical/lxd/security/advisories/GHSA-v9wr-9r7q-fh4g",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory",
        "Exploit",
        "Mitigation"
      ]
    },
    {
      "url": "https://github.com/canonical/lxd/security/advisories/GHSA-v9wr-9r7q-fh4g",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Vendor Advisory",
        "Exploit",
        "Mitigation"
      ]
    }
  ]
}