LXD Missing Auth in imgDownload pre5.0.10,5.21.8,6.10
CVE-2026-86335 Published on September 28, 2026
LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse
Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests.
Vulnerability Analysis
CVE-2026-86335 can be exploited with network access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-86335 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-86335
Want to know whenever a new CVE is published for Canonical Lxd? stack.watch will email you.
Affected Versions
Canonical LXD:- Version 5.21.0 and below 5.21.8 is affected.
- Version 6.0 and below 6.10 is affected.
- Version 4.0 and below 5.0.10 is affected.