CVE-2026-86335 — LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse
Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects …
Published: 2026-09-28 · CVSS: 6.3 · CVSS 3.1
Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7