← Database

CVE-2026-86335

MEDIUM CVSS: 6.3 Published: 2026-09-28 Modified: 2026-09-28

Description

Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests.

Affected Platforms

Unknown

Weakness Type

CWE-862

References