CVE-2026-86335

MEDIUMCVSS 6.3

Description

Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests.

Timeline

Published:September 28th, 2026 2:17 PM

Last modified:September 28th, 2026 5:17 PM

CVSS Scoring

CVSS v3: 6.3 (MEDIUM)

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Weaknesses (CWE)

CWE-862

References & Reports

Advisories, patches, and third-party reports

https://github.com/canonical/lxd/pull/18987
https://github.com/canonical/lxd/pull/19001
https://github.com/canonical/lxd/pull/19002
https://github.com/canonical/lxd/pull/19003
https://github.com/canonical/lxd/security/advisories/GHSA-j7p3-5g2v-69j8

Source: NIST NVD · Data may lag official sources by up to one minute