CVE-2025-54291

MEDIUM

Canonical LXD < 5.21.4 - Unauthenticated Information Disclosure via Images API

Title source: llm
STIX 2.1

Description

Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.

References (1)

Core 1

Scores

CVSS v3 5.3
EPSS 0.0035
EPSS Percentile 26.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-209
Status published
Products (2)
canonical/lxd 4.0 - 5.21.4Go
canonical/lxd 4.0.0 - 5.21.4
Published Oct 02, 2025
Tracked Since Feb 18, 2026