Quick answers
- Is CVE-2026-86335 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-86335 being exploited in the wild.
- How severe is CVE-2026-86335?
- Medium severity, with a CVSS score of 6.3, published 28 September 2026.
- Which products and versions are affected?
- Canonical LXD before 5.0.10, before 5.21.8, before 6.10.
- Is there a fix for CVE-2026-86335?
- A patch was published on 2026-09: Fix merged in PR #18987 (main branch) and PR #19001 (release-6.9) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-86335 attacked?
- It is attacked with local access, in a network appliance.
- Am I affected by CVE-2026-86335?
- Check whether you run Canonical LXD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
Missing authorization in the imageDownload function fails to validate project boundaries, allowing project-restricted clients to access private images from other projects via local fingerprint reuse during image or instance import requests. The vulnerability requires local access to the LXD daemon and affects versions before 5.0.10, 5.21.8, and 6.10. A fix restricting image reuse to cached images with identical image source has been merged.
Affected products
- Canonical LXD before 5.0.10, before 5.21.8, before 6.10
Timeline
- 2026-09-28: disclosed
- 2026-09: patched: Fix merged in PR #18987 (main branch) and PR #19001 (release-6.9)