CVE-2026-86335
Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests.
- Published Sep 28, 2026
- CVSS 6.3 medium
- 0.2% chance of exploitation in the next 30 days (EPSS)
- A fix is available