The vulnerability arises from improper handling of project-restriction policies during snapshot restoration in LXD. An authenticated operator can import a backup containing restricted configuration keys. When the snapshot is restored, these keys are applied without policy validation and starting the instance grants host root privileges, making it a clear privilege escalation flaw (CWE‑863). The breach allows unauthorized escalation to the host level within a multi‑tenant environment.

The affected product is Canonical LXD. Versions prior to 6.9, 5.21.5, and 5.0.7 are impacted. Specifically, LXD 6.0 through 6.8, 5.21.0 through 5.21.4, and 5.0.0 through 5.0.6 are vulnerable.

The vulnerability has a CVSS score of 7.2 and no EPSS score is available, and it is not listed in the KEV catalog. An attacker must be an authenticated project operator in a multi‑tenant setup; the exploit requires crafting a malicious snapshot and importing it. Once the instance starts, host root access is achieved. The lack of an EPSS score and KEV listing suggests that widespread exploitation is not yet documented, but the high impact warrants prompt remediation.