https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T12:44:16.661872+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-254022 EUVD-2026-254022 2026-10-03T12:44:16.666770+00:00 EUVD-2026-254022 https://cve.radiocsirt.org/vuln/fkie_cve-2025-54291 fkie_cve-2025-54291 2026-10-03T12:44:16.666803+00:00

Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.

 https://cve.radiocsirt.org/vuln/ghsa-xch9-h8qw-85c7 GHSA-xch9-h8qw-85c7 — Canonical LXD Project Existence Determination Through Error Handling in Image Get Function 2026-10-03T12:44:16.666833+00:00

Affected: Go: github.com/canonical/lxd

### Impact The LXD /1.0/images endpoint is implemented as an AllowUntrusted API that requires no authentication, making it accessible to users without accounts. This API allows determining project existence through differences in HTTP status codes when accessed with the project parameter.

https://github.com/canonical/lxd/blob/43d5189564d27f6161b430ed258c8b56603c2759/lxd/images.go#L63-L69

This configuration allows access without authentication:

https://github.com/canonical/lxd/blob/43d5189564d27f6161b430ed258c8b56603c2759/lxd/daemon.go#L924-L926

This API returns a 404 error when accessing existing projects and a 403 error when accessing non-existent projects, allowing confirmation of project existence through this difference.

The problematic implementation is shown below.

First, in the error handling implementation of the imagesGet function below, project existence is checked within the `projectutils.ImageProject` function, and the err returned by the `ImageProject` function is directly returned to the user.

https://github.com/canonical/lxd/blob/43d5189564d27f6161b430ed258c8b56603c2759/lxd/i mages.go#L1781-L1788

When the project doesn't exist, the error is 404 (http.StatusNotFound), which is returned to the user:

https://github.com/canonical/lxd/blob/43d5189564d27f6161b430ed258c8b56603c2759/lxd/db/cluster/projects.mapper.go#L237-L239

On the other hand, when the project exists but the user lacks viewing permissions, the imagesGet function returns 403 (response.Forb…

 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15710-1 openSUSE-SU-2025:15710-1 — govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media 2026-10-03T12:44:16.666887+00:00

govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-54291 Withdrawn: UBUNTU-CVE-2025-54291 2026-10-03T12:44:16.666922+00:00

Withdrawn by the publisher.

Affected: Ubuntu:Pro:16.04:LTS: lxd, Ubuntu:Pro:18.04:LTS: lxd, Ubuntu:20.04:LTS: lxd

Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.