Information Disclosure in Canonical LXD Images API
CVE-2025-54291

6.9MEDIUM

Key Information:

Vendor

Canonical

Status
Lxd
Vendor
CVE Published:
2 October 2025

What is CVE-2025-54291?

The information disclosure vulnerability in the images API of Canonical LXD versions prior to 6.5 and 5.21.4 permits unauthenticated remote attackers to ascertain the existence of projects. This is achieved through variations in the HTTP status codes returned, which can inadvertently reveal sensitive information regarding project configurations and availability.

Affected Version(s)

LXD 6.0 < 6.5

LXD 5.21 < 5.21.4

References

https://github.com/canonical/lxd/security/advisories/GHSA...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.