Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2026-86335

LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
canonical

Description

Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Canonical LXD

Default version status: unaffected

  • 5.21.0 to < 5.21.8affected
  • 6.0 to < 6.10affected
  • 4.0 to < 5.0.10affected

References