CVE-2026-86335
published 2026-09-28CVE-2026-86335: Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images…
PriorityP338medium6.3CVSS 3.1
AVNACHPRLUINSCCHINAN
EPSS
0.22%
12.4th percentile
Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | lxd | >= 4.0 < 5.0.10 | 5.0.10 |
| canonical | lxd | >= 5.21.0 < 5.21.8 | 5.21.8 |
| canonical | lxd | >= 6.0 < 6.10 | 6.10 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No advisories linked to this vulnerability.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-28
Published