CVE-2026-86335

6.3 MEDIUMpublic exploit available

Published 2026-09-28 · Updated 2026-09-28

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Weaknesses

CWE-862

Public exploit & PoC references

https://github.com/canonical/lxd/pull/18987
https://github.com/canonical/lxd/pull/19001
https://github.com/canonical/lxd/pull/19002
https://github.com/canonical/lxd/pull/19003
https://github.com/canonical/lxd/security/advisories/GHSA-j7p3-5g2v-69j8

All references

https://github.com/canonical/lxd/pull/18987
https://github.com/canonical/lxd/pull/19001
https://github.com/canonical/lxd/pull/19002
https://github.com/canonical/lxd/pull/19003
https://github.com/canonical/lxd/security/advisories/GHSA-j7p3-5g2v-69j8

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2025-14484
MEDIUMCVE-2025-14486
MEDIUMCVE-2025-14487
UNSCOREDCVE-2026-100240
MEDIUMCVE-2026-100287
MEDIUMCVE-2026-100289
MEDIUMCVE-2026-100303PoC
MEDIUMCVE-2026-100305PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.