CVE-2025-54291
published 2025-10-02CVE-2025-54291: Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project…
PriorityP433medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.36%
28.1th percentile
Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | lxd | >= 4.0.0 < 5.21.4 | 5.21.4 |
| canonical | lxd | >= 5.21 < 5.21.4 | 5.21.4 |
| canonical | lxd | >= 6.0 < 6.5 | 6.5 |
| canonical | lxd | >= 6.1 < 6.5 | 6.5 |
| debian | incus | < incus 6.0.5-1 (forky) | incus 6.0.5-1 (forky) |
| debian | lxd | < incus 6.0.5-1 (forky) | incus 6.0.5-1 (forky) |
| github.com | canonical_lxd | >= 0.0.0-20200331193331-03aab09f5b5c < 0.0.0-20250827065555-0494f5d47e41 | 0.0.0-20250827065555-0494f5d47e41 |
| github.com | canonical_lxd | >= 4.0 < 5.21.4 | 5.21.4 |
| github.com | canonical_lxd | >= 6.0 < 6.5 | 6.5 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv6.9MEDIUM
vendor_debian6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Canonical LXD Project Existence Determination Through Error Handling in Image Get Function in github.com/canonical/lxd
osv·2025-11-05
CVE-2025-54291 Canonical LXD Project Existence Determination Through Error Handling in Image Get Function in github.com/canonical/lxd
Canonical LXD Project Existence Determination Through Error Handling in Image Get Function in github.com/canonical/lxd
Canonical LXD Project Existence Determination Through Error Handling in Image Get Function in github.com/canonical/lxd
OSV
Canonical LXD Project Existence Determination Through Error Handling in Image Get Function
osv·2025-10-02
CVE-2025-54291 [MEDIUM] Canonical LXD Project Existence Determination Through Error Handling in Image Get Function
Canonical LXD Project Existence Determination Through Error Handling in Image Get Function
### Impact
The LXD /1.0/images endpoint is implemented as an AllowUntrusted API that requires no authentication, making it accessible to users without accounts. This API allows determining project existence through differences in HTTP status codes when accessed with the project parameter.
https://github.com/canonical/lxd/blob/43d5189564d27f6161b430ed258c8b56603c2759/lxd/images.go#L63-L69
This configuration allows access without authentication:
https://github.com/canonical/lxd/blob/43d5189564d27f6161b430ed258c8b56603c2759/lxd/daemon.go#L924-L926
This API returns a 404 error when accessing existing projects and a 403 error when accessing non-existent projects, allowing confirmation of project exi
OSV
CVE-2025-54291: Information disclosure in images API in Canonical LXD before 6
osv·2025-10-02·CVSS 6.9
CVE-2025-54291 [MEDIUM] CVE-2025-54291: Information disclosure in images API in Canonical LXD before 6
Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.
GHSA
Canonical LXD Project Existence Determination Through Error Handling in Image Get Function
ghsa·2025-10-02
CVE-2025-54291 [MEDIUM] CWE-209 Canonical LXD Project Existence Determination Through Error Handling in Image Get Function
Canonical LXD Project Existence Determination Through Error Handling in Image Get Function
### Impact
The LXD /1.0/images endpoint is implemented as an AllowUntrusted API that requires no authentication, making it accessible to users without accounts. This API allows determining project existence through differences in HTTP status codes when accessed with the project parameter.
https://github.com/canonical/lxd/blob/43d5189564d27f6161b430ed258c8b56603c2759/lxd/images.go#L63-L69
This configuration allows access without authentication:
https://github.com/canonical/lxd/blob/43d5189564d27f6161b430ed258c8b56603c2759/lxd/daemon.go#L924-L926
This API returns a 404 error when accessing existing projects and a 403 error when accessing non-existent projects, allowing confirmation of project exi
Debian
CVE-2025-54291: incus - Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on a...
vendor_debian·2025·CVSS 6.9
CVE-2025-54291 [MEDIUM] CVE-2025-54291: incus - Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on a...
Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.
Scope: local
forky: resolved (fixed in 6.0.5-1)
sid: resolved (fixed in 6.0.5-1)
trixie: resolved (fixed in 6.0.4-2+deb13u1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-10-02
Published