CVE-2025-54290
Publication date 2 October 2025
Last updated 20 January 2026
Ubuntu priority
Description
Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| lxd | 25.10 questing | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial |
Not affected
|
Notes
iconstantin
earlier versions of LXD lack the logic to process or filter by project via the image export API.