CVE-2026-63297

Katalog CVE

CVSS 9.9 · Critical EPSS 0,34%

Kerentanan Time-of-check Time-of-use (TOCTOU) Race Condition pada canonical lxd. Skor CVSS 3.1 9.9 (Critical) menurut ubuntu.com.

Deskripsi (NVD)

An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction checks before configuration merging is complete, creating a time-of-check to time-of-use (TOCTOU) condition. An attacker can exploit this flaw to copy instances with disallowed high-privilege configurations into restricted projects, bypassing security controls.

Rincian

Terbit di NVD

12 Agustus 2026

Terakhir diubah

11 September 2026

Status NVD

Analyzed

CVSS 3.1

9.9 (Critical), sumber ubuntu.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-863: Incorrect Authorization

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 26,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/canonical/lxd/security/advisories/GHSA-v989-qw7w-xvg4 advisory vendor · exploit · mitigasi