CVE-2026-86335
MEDIUM
NVD
CVSS Score
6.3
Severity
MEDIUM
Published
Sep 28, 2026
Vendor
unknown
Description
Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests.