Description

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges (such as enforcing restricted.containers.privilege=isolated), LXD fails to enforce the requirement if an instance configuration omits the security.idmap.isolated key. An attacker can exploit this flaw by creating or updating an instance without explicitly setting security.idmap.isolated, bypassing the target project's security constraints.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-12T20:17:47.303Z",
  "pubdate": "2026-08-12T20:17:47.303Z",
  "executiveSummary": "An authorization bypass vulnerability exists within LXD that allows authenticated attackers to circumvent project-level container isolation restrictions.\nThe vulnerability affects LXD instances configured with project restrictions enforcing container privileges, specifically when utilizing restricted.containers.privilege=isolated.\nThe primary impact is the unauthorized deployment or modification of container instances with elevated privileges, effectively shattering the multi-tenant isolation boundaries established by project administrators.\nAn attacker capable of authenticating to the LXD API can exploit this flaw to execute arbitrary containers outside the intended security constraints of their assigned project.\nExploitation requires valid authentication credentials to the LXD daemon and the ability to create or update instance configurations, but does not necessitate explicit prior privilege within the target isolated project.\nThe risk implication is severe in shared environments, as malicious actors can escalate their operational capabilities by bypassing strict administrative guardrails designed to prevent unprivileged container abuse.",
  "technicalDetails": "The root cause of the vulnerability lies in improper input validation and access control enforcement within the LXD instance creation and update handling logic.\nWhen a project is subjected to strict security policies such as restricted.containers.privilege=isolated, the LXD validation engine is designed to inspect incoming configuration payloads to ensure compliance with isolation directives.\nThe flaw manifests because LXD fails to properly enforce this requirement when an attacker submits an instance configuration that completely omits the security.idmap.isolated key.\nInstead of defaulting to a secure state or rejecting the malformed or incomplete payload, the authorization and validation checks incorrectly bypass the enforcement of the project-level policy.\nThe vulnerable component is the LXD project policy enforcement module responsible for validating instance creation and modification requests against defined project restrictions.\nRegarding authentication and privilege requirements, the attacker must possess valid authentication credentials to interact with the LXD API daemon, though they typically operate within the confines of a restricted project.\nThe attack flow proceeds as follows: First, the authenticated attacker crafts an API request to create a new instance or update an existing one within a target project governed by isolation restrictions. Second, the attacker deliberately omits the security.idmap.isolated configuration key from the JSON payload. Third, the LXD daemon processes the request, fails to evaluate the omitted key against the mandatory project constraints, and improperly approves the instantiation. Finally, the instance is spawned without the required isolation parameters, granting the attacker unauthorized control over container privilege boundaries.\nPost-exploitation impact includes the potential execution of privileged containers, resource manipulation, and potential container breakout or host compromise depending on the broader system configuration and kernel security features."
}