CVE-2026-86335CWE-862broken-access-control

CVE-2026-86335

Medium · published September 28, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
12.4
In the wild
Unconfirmed
What it is

Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00225 · 12.4th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-28T18:17Z
References (5)
https://github.com/canonical/lxd/pull/18987 · [email protected]https://github.com/canonical/lxd/pull/19001 · [email protected]https://github.com/canonical/lxd/pull/19002 · [email protected]https://github.com/canonical/lxd/pull/19003 · [email protected]https://github.com/canonical/lxd/security/advisories/GHSA-j7p3-5g2v-69j8 · [email protected]
EPSS history
Timeline
  • 30 SEP 03:29Z
    EPSS moved — → 0%
    epss
  • 28 SEP 13:21Z
    LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse
    cvelistv5