CVE-2026-86335

Name of the Vulnerable Software and Affected Versions Canonical LXD versions prior to 5.0.10 Canonical LXD versions prior to 5.21.8 Canonical LXD versions prior to 6.10

Description An authorization flaw exists in the imageDownload() function on Linux. This issue allows a client restricted to a specific project to access private images belonging to other projects by reusing local fingerprints during requests to import images or instances.

Recommendations Update to version 5.0.10 or later. Update to version 5.21.8 or later. Update to version 6.10 or later.