Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N C H H H 9.9 .0054 43.4 —
AFFECTED Product Versions Fixed LXD 5.0.0 – —
TIMELINE Jul 14 Reserved by canonical Aug 12 Published (CNA: canonical) Sep 11 EXPLOIT PUBLISHED — CVE-2026-62420 (Canonical LXD). Public exploit reference added.
An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/{name} with migration: true, project: <target>, and target: <member>, the destination node skips all project restriction checks because the request arrives as an internal cluster notification. An attacker can exploit this to introduce disallowed instance configurations into a restricted project.
| Date | Event | Detail |
|---|---|---|
| July 14, 2026 | Reserved | Reserved by canonical |
| August 12, 2026 | Published | Published (CNA: canonical) |
| September 11, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-62420 (Canonical LXD). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Canonical | LXD | — | 5.0.0 | — |
Authoritative record: CVE-2026-62420 at cve.org
Vendors: canonical
Weaknesses: CWE-863
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-62420 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
