Authorization Bypass in Canonical LXD Image Import

Executive Summary

CVE-2026-86335 is a missing authorization vulnerability in Canonical LXD before versions 5.0.10, 5.21.8, and 6.10. It allows a project-restricted client with limited permissions to access private images from other projects by reusing a local image fingerprint during import requests. The vulnerability bypasses project isolation by exploiting the imageDownload function's lack of proper permission checks.

Useful 0 Not Useful 0

Detection Guidance

To detect CVE-2026-86335, check LXD logs for unauthorized image imports across projects. Look for instances where a project-restricted client accesses private images using a known fingerprint. Commands like 'lxc image list --all-projects' and 'journalctl -u lxd' may reveal suspicious activity. Ensure no unauthorized image reuse occurs between projects.

Useful 0 Not Useful 0

Impact Analysis

An attacker with restricted access can import private images from other projects into their own, gaining unauthorized access to sensitive data. They can view, export, or launch instances from these images. The attack requires knowledge of the target image's 64-hex fingerprint, which may be obtained through logs or backups.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to private data, violating confidentiality requirements in GDPR and HIPAA. It undermines data protection measures by allowing unauthorized users to access sensitive information, potentially resulting in compliance breaches and legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade LXD to versions 5.0.10, 5.21.8, or 6.10 or later. Verify the fix by checking that image reuse is restricted to cached images with identical sources. Review project permissions to ensure only authorized users can access private images. Monitor logs for any unauthorized access attempts.

Useful 0 Not Useful 0