LXD restricted project bypass allows arbitrary command execution

Tier B · Patch this week – Put it in the sprint

Who’s exposed: LXD and Incus servers using restricted projects

Tier B because: Full takeover OR secrets exposed OR supply chain

Reach

Attack

Damage

Fix

Full takeover

The Brief

The GitHub Advisory Database published an advisory on 2026-11-06 for a restricted project bypass in LXD.
Instance snapshots ignore the restricted.containers.lowlevel=block setting.
The flaw allows arbitrary command execution on the Incus server.

Operators who rely on restricted projects to limit low-level container settings may be exposed to command execution on their host server.

Checklist · 2 of 10 yes

Yes	Hits tech teams	Judgment: LXD is server software for container and VM hosts that ops teams run.
No	Core infrastructure	Judgment: LXD is a single container manager, not software nearly every team runs.
No	Popular tool	Judgment: LXD is a niche system container manager, not a mainstream developer tool.
No	Exploited in the wild	GitHub Advisory Database: advisory describes the flaw only; no observed attacks reported.
No	Public exploit	GitHub Advisory Database: advisory summary gives no published exploit or PoC.
No	Remote, no login	GitHub Advisory Database: sources do not say the attack needs no credentials over the network.
Yes	Full takeover	GitHub Advisory Database: flaw allows arbitrary command execution on the Incus server.
No	Secrets exposed	GitHub Advisory Database: sources report no stolen or exposed secrets, configs or data.
No	Supply chain	GitHub Advisory Database: a normal vulnerability in legitimate code, not malicious shipped code.
No	No fix yet	GitHub Advisory Database: sources do not state whether a patched version exists.

First seen 2h ago · 1 source · Full story page · How tiers are decided