CVE-2026-86335

Published: Sep 28, 2026Modified: Sep 28, 2026Deferred

6.3

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 4.0

Source: security@ubuntu.com (Secondary)

Description

Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests.

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (5)

https://github.com/canonical/lxd/pull/18987

Source: security@ubuntu.com

https://github.com/canonical/lxd/pull/19001

Source: security@ubuntu.com

https://github.com/canonical/lxd/pull/19002

Source: security@ubuntu.com

https://github.com/canonical/lxd/pull/19003

Source: security@ubuntu.com

https://github.com/canonical/lxd/security/advisories/GHSA-j7p3-5g2v-69j8

Source: security@ubuntu.com

Timeline

No history available yet.