Vulnerabilities

TI-2026-64040 CVE-2026-97335

Incorrect authorization in LXD storage volume API allows reading volumes from other projects

LOW 33

Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed in 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create custom…

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00205 Published 2026-09-28 Fixed in 5.0.10, 5.21.8 +1 CWE-863

TI-2026-59107 CVE-2026-86335

LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse

LOW 27

Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or…

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00225 Published 2026-09-28 Fixed in 5.21.8, 6.10 +1 CWE-862

Vulnerabilities

Filters

Incorrect authorization in LXD storage volume API allows reading volumes from other projects

LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse