CVE-2026-86335

Executive Summary

CVE-2026-86335 is a Missing Authorization (CWE-862) vulnerability in the imageDownload component of Canonical LXD, an open-source system container and virtual machine manager. LXD versions before 5.0.10, 5.21.8, and 6.10 on Linux permit a project-restricted client to access private images belonging to other projects by reusing a local image fingerprint during image or instance import requests. The impact is a cross-project confidentiality breach: a low-privileged, project-scoped client can read image content it is not authorized to see, though integrity and availability are unaffected.

Technical Analysis

The vulnerability resides in the authorization logic of imageDownload, the LXD subsystem responsible for resolving and fetching images during image or instance import operations. LXD organizes workloads into projects, a multi-tenancy construct that isolates instances, images, and other resources between tenants. Access control is expected to scope every image lookup to the requesting client's project set. Per the NVD description, this check is missing (CWE-862) in the affected versions.

The specific mechanism is local fingerprint reuse. LXD images are identified by content fingerprints (SHA-256 digests of the image). When an import request references an image, LXD can satisfy it from the local image store if a matching fingerprint already exists, rather than contacting a remote image server. The flaw is that the local-store lookup path in imageDownload does not enforce that the requesting client is authorized for the project that owns the locally stored image. A client whose privileges are restricted to Project A can therefore supply—or reference—a fingerprint that is already present locally because Project B previously fetched that image. imageDownload resolves the request against the shared local store and serves the content without a cross-project authorization check.

Key characteristics of the attack surface:

• Authentication is required. The vector is PR:L (Low privileges). The attacker needs a valid LXD client identity that is confined to a project—this is the normal posture for a tenant in a multi-project LXD deployment, not an anonymous attacker.
• Attack complexity is High (AC:H). Successful exploitation depends on the targeted private image already existing in the node's local image store, which the attacker must know or discover (the fingerprint). This precondition reduces exploitability and is reflected in the CVSS score.
• Scope is Changed (S:C). The authorization boundary being crossed is the project tenancy boundary. Compromise of one project's access controls affects the confidentiality of a different project's resources—an authority outside the vulnerable component's own security scope.
• Confidentiality only (C:H/I:N/A:N). The flaw exposes image contents; it does not permit modification, deletion, or denial of service based on the description provided.

No function signatures, HTTP endpoint paths, API parameter names, or file paths beyond the imageDownload component name are provided in the source data, and none are invented here. The description is sparse on the exact wire format and API versioning, so the analysis remains at the vulnerability-class and mechanism level: an authorization bypass in a resource-resolution path, enabled by a shared, cross-project local cache and a client-controllable identifier (fingerprint).

Exploitation Scenarios

Preconditions. The attacker holds a LXD client certificate or token scoped to a restricted project (Project A) on a shared LXD node. A victim project (Project B) stores at least one private image in the node's local image store. The attacker can reach the LXD API over the network (AV:N).

1. Reconnaissance / target identification. The attacker, acting as a Project A tenant, probes the LXD API and attempts to enumerate or infer which image fingerprints exist locally. Fingerprints are content-addressed identifiers (SHA-256 digests), so the attacker must either obtain a candidate fingerprint through information leakage or other project activity, or guess/replay a known digest. Because the description notes the precondition of "local fingerprint reuse," reconnaissance focuses on identifying a fingerprint already cached on the node.

2. Triggering the missing authorization check. The attacker issues an image or instance import request that references the targeted fingerprint but does not specify a remote source that would require a fresh download—deliberately steering resolution into the local image store path of imageDownload. The request is authenticated as a Project A client. Because the imageDownload local-lookup path lacks a project-ownership authorization check, the request is not rejected on the basis of the Project B origin of the image.

3. Payload / execution method. At the vulnerability-class level, the "payload" is simply the crafted import request bearing the target fingerprint. No remote code execution or memory corruption is involved; this is a logic/authorization bypass. The request does not exploit injected code—it exploits the absence of an ownership check, causing LXD to serve the locally stored image content to an unauthorized project client. No public PoC or exploit code exists; the attack chain is inferred from the vulnerability class (CWE-862) and the described mechanism.

4. Post-exploitation impact. The attacker obtains the private image belonging to Project B. Image contents may include embedded configuration, secrets, application source, provisioning scripts, or credentials baked into the image—data the attacker is not entitled to. This expands the attacker's knowledge of the victim tenant and may enable lateral movement or further targeting. Integrity and availability of the victim's images are unaffected.

Note: the attacker must be an authenticated, project-restricted client; this is not a pre-authentication or anonymous attack. Exploitation is also contingent on the target image being locally cached (AC:H).

Impact Assessment

The business impact is a cross-tenant confidentiality breach in multi-project LXD deployments—a common architecture in managed container hosting, CI/CD image caches, and shared private-cloud platforms. A restricted tenant can read images belonging to other tenants on the same node.

• Confidentiality: High (C:H). Private image contents are fully exposed to an unauthorized project.
• Integrity: None (I:N). The description indicates no modification of data.
• Availability: None (A:N). No DoS or resource-denial component is described.
• Privileges Required: Low (PR:L). A normal project-scoped client credential suffices.
• Attack Complexity: High (AC:H). Requires a locally cached target image and knowledge of (or ability to derive) the fingerprint.
• Scope: Changed (S:C). The violation crosses the project tenancy boundary, affecting a security authority separate from the vulnerable component.
• CVSS Base: 6.3 (Medium). Consistent with a confidentiality-focused, precondition-constrained tenancy bypass.

Blast radius. Any LXD node hosting multiple projects that share a local image store. The operative constraint is the local-cache precondition: exposure is limited to images already present on the node, not the entire remote image catalog. Trust boundaries affected are the project isolation boundary and any assumption that "restricted project clients cannot read other projects' images." Organizations using LXD as a multi-tenant platform—especially where golden images or tenant-specific builds contain embedded secrets—face the highest risk.

Detection Guidance

Sigma Rule

title: LXD Cross-Project Image Fingerprint Reuse Authorization Bypass
id: 5b3a9c1e-7d2f-4a60-9c88-1f0e2a6b4d13
status: experimental
description: Detects LXD API import requests that reference image fingerprints, potentially abusing missing authorization in imageDownload to access private images across projects.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-86335
author: valtersit.com
date: 2026-01-01
tags:
  - attack.t1213
  - cve.2026-86335
logsource:
  product: lxd
  service: api
detection:
  selection_method:
    http.method:
      - GET
      - POST
  selection_path:
    http.url|contains:
      - '/images'
      - '/instances'
  selection_import:
    http.url|contains:
      - 'fingerprint'
      - 'source'
  selection_op:
    op|contains:
      - 'image'
      - 'import'
  condition: selection_method and selection_path and (selection_import or selection_op)
falsepositives:
  - Legitimate image pulls within a project's own scope
  - Administrative image management operations
level: medium

YARA Rule

rule CVE_2026_86335_LXD_ImageDownload_AuthzBypass
{
    meta:
        description = "Heuristic detection of LXD imageDownload cross-project fingerprint reuse indicators in logs or artifacts"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-86335"
        author = "valtersit.com"
        date = "2026-01-01"
        cve = "CVE-2026-86335"

    strings:
        $lxd   = "lxd" nocase
        $img   = "image" nocase
        $dl    = "imageDownload" ascii
        $fp    = "fingerprint" nocase
        $proj  = "project" nocase
        $authz = "authorization" nocase

    condition:
        filesize < 5MB and
        $lxd and $img and $fp and $proj and
        (1 of ($dl, $authz))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-86335 LXD Possible Cross-Project Image Fingerprint Reuse (imageDownload)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/images"; http.uri; content:"fingerprint"; http.uri; content:"project"; classtype:attempted-recon; sid:210086335; rev:1; reference:cve,2026-86335; metadata:service lxd;)

Elastic Detection

api where http.method in ("POST", "GET")
  and http.url : ("*/images*" or "*/instances*")
  and http.url : "*fingerprint*"
  and process.name : ("lxd" or "lxc")

Splunk SPL Query

index=lxd OR index=syslog sourcetype=lxd:api OR sourcetype=lxd
| search ("imageDownload" OR (http.url="*fingerprint*" AND (http.url="*/images*" OR http.url="*/instances*")))
| where (upper(privilege)="LOW" OR project_restricted="true")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(http.url) as urls values(src) as srcs
        by user, project, fingerprint
| where count > 0
| eval severity="medium", cve="CVE-2026-86335"
| sort - count

Wazuh OSSEC Rule

<group name="lxd,cve-2026-86335,">
  <rule id="100863" level="8">
    <decoded_as>json</decoded_as>
    <field name="http.url">\/images|\/instances</field>
    <field name="http.url">fingerprint</field>
    <description>CVE-2026-86335: LXD import request referencing image fingerprint - possible cross-project imageDownload authorization bypass</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>cve_2026_86335,lxd,authorization_bypass,</group>
  </rule>
  <rule id="100864" level="10">
    <if_sid>100863</if_sid>
    <field name="project_restricted">true</field>
    <description>CVE-2026-86335: Project-restricted LXD client accessed image fingerprint - likely unauthorized cross-project image access</description>
    <group>cve_2026_86335,lxd,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED) — no patch evidence from any tracked source. Although the NVD description references fixed releases 5.0.10, 5.21.8, and 6.10, no authoritative vendor advisory, commit hash, or release artifact has been confirmed. Treat all versions below these thresholds as vulnerable and validate any upgrade against Canonical's official channels before relying on it. No workarounds are provided in the source data.

1) Immediate mitigations (no confirmed patch available):

• Restrict network access to the LXD API. Bind the API to a management network or local socket only, and terminate remote access behind an authenticated gateway with strict tenant segmentation. This reduces AV:N exposure.
• Do not co-locate multiple untrusted tenants that share a single local image store on the same LXD node. Isolate projects onto separate nodes or separate LXD instances so that a local fingerprint cannot be reused across a tenancy boundary.
• Audit project RBAC: ensure restricted projects cannot enumerate image fingerprints belonging to other projects, and monitor for clients issuing import requests with foreign fingerprints.
• Minimize sensitive data baked into images (embedded credentials, tokens, provisioning secrets); rotate any secrets that may have been embedded in images reachable across projects.
• Where feasible, clear or separate per-project local image caches so that victim images are not present in a store accessible to attacker-controlled projects.

2) Patch / upgrade steps:

• Monitor Canonical's official LXD security advisories and the upstream LXD repository for the authoritative fix commits corresponding to the 5.0.10, 5.21.8, and 6.10 release tracks.
• Once a verified patch is published, upgrade LXD: LTS 5.0.x users to 5.0.10 or later; 5.21.x users to 5.21.8 or later; 6.x users to 6.10 or later — subject to confirmation from the vendor.
• Re-verify authorization behavior after upgrade by testing cross-project fingerprint reuse with a restricted client in a staging environment.

3) Long-term hardening:

• Adopt infrastructure-as-code to keep LXD current, and subscribe to Canonical security notices for prompt patch intake.
• Enforce least privilege for project clients; avoid granting image-management or cross-project privileges to tenant accounts.
• Implement centralized audit logging of all LXD API import/export operations correlated with project identity, and alert on any request referencing a fingerprint outside the caller's project scope.
• Treat multi-tenant LXD deployments as shared-trust-boundary systems and apply defense-in-depth: network isolation, per-tenant nodes where feasible, and secret-scanning of images prior to publication.

References

• NVD — CVE-2026-86335: https://nvd.nist.gov/vuln/detail/CVE-2026-86335
• CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• Canonical LXD project (upstream repository and security advisories): https://github.com/canonical/lxd
• Canonical security notices portal: https://ubuntu.com/security/notices
• MITRE ATT&CK T1213 — Data from Information Repositories: https://attack.mitre.org/techniques/T1213/

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-86335, and the CVE is not listed in CISA KEV. No threat actor campaigns or in-the-wild exploitation have been reported as of the source data provided.