CVE-2025-54291 — Project existence disclosure in LXD images API

CVE-2025-54291

Project existence disclosure in LXD images API PUBLISHED

Description (CNA)

Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.

Affected (CNA)

Vendor / product	Versions
Canonical / LXD	affected 6.0 before 6.5; affected 5.21 before 5.21.4

CWE

CWE-209

References

https://github.com/canonical/lxd/security/advisories/GHSA-xch9-h8qw-85c7

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.