A flaw in Canonical LXD versions before 6.8 allows a backup import to be crafted so that the backup/index.yaml file, which is checked against project restrictions, is not used for validating the instance configuration. The instance is created from backup/container/backup.yaml, which is never subject to the same checks. An authenticated remote attacker with permission to create instances in a restricted project can therefore inject privileged settings such as security.privileged=true or raw.lxc directives, bypassing all project restrictions and enabling full control over the host.

The vulnerability affects Canonical LXD installations prior to version 6.8. Any deployment running a 6.7 or earlier LXD instance that accepts backup imports from potentially untrusted sources is at risk.

The flaw carries a CVSS score of 9.1, indicating critical severity. Although no EPSS score is available, the attack is feasible for attackers who have valid instance‑creation permissions within a restricted project; they can craft a malicious backup archive and trigger the import. The vulnerability is not listed in the CISA KEV catalog, but the potential for complete host compromise makes the risk high regardless of exploit campaign activity.