CVE-2026-86335: LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse
Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Canonical LXDto a version that resolves this vulnerability.Fixed in 5.0.10 - Upgrade
Upgrade
Canonical LXDto a version that resolves this vulnerability.Fixed in 5.21.8 - Upgrade
Upgrade
Canonical LXDto a version that resolves this vulnerability.Fixed in 6.10
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already have project-restricted access to an affected LXD deployment. The issue is exposed through image or instance import requests that reuse a local image fingerprint.
What data could be exposed?
A project-restricted client may obtain access to private images belonging to other projects. The listed impact is confidentiality only; integrity and availability are not affected.
Which versions are affected?
The issue affects Canonical LXD versions before 5.0.10, 5.21.8, and 6.10 on Linux.
Does exploitation require user interaction or network access?
The vulnerability is network-reachable and does not require user interaction. Exploitation has high attack complexity and requires low-level privileges.