Canonical LXD EUVD-2025-32641

The /1.0/images endpoint is explicitly an AllowUntrusted LXD API requiring no authentication, so no special application configuration is needed once the API is reachable - the leak occurs against default handling of the project query parameter. The key limiting factor is network exposure: LXD by default listens only on a local Unix socket, so the HTTPS API (typically port 8443) must have been deliberately enabled via core.https_address for a remote attacker to reach it. Exploitation is therefore unauthenticated and low-complexity where the network API is exposed, but confined to confirming project existence (a reconnaissance oracle) with no access to private data; affected versions are LXD >=5.21 <5.21.4 and >=6.0 <6.5.

This is a low-severity information disclosure issue despite its CVSS 4.0 base score of 6.9. The signals are largely consistent in pointing to limited real-world risk: the EPSS probability is just 0.09% (25th percentile), the vulnerability is NOT in CISA KEV (no confirmed active exploitation), and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) correctly reflects a network-reachable, unauthenticated flaw whose only impact is LOW confidentiality - leakage of project-existence metadata, not credentials, code execution, or data. A public proof-of-concept exists (the GHSA advisory contains full curl reproduction steps), which raises ease-of-use, but POC availability is a distinct signal from active exploitation and should not be conflated with it. The one caveat worth flagging: the 6.9 base score overstates practical priority because exploitation yields only an oracle for project names - valuable for reconnaissance but not directly impactful. Treat this as a reconnaissance/information-leak hygiene fix to schedule with normal patch cycles, not an emergency.

An unauthenticated attacker who can reach a network-exposed LXD HTTPS API sends requests to the /1.0/images endpoint with a crafted project parameter and compares the HTTP error codes - a 404 ('Project not found') versus a 403 ('Untrusted callers may only access public images') reveals whether a named project exists. A public proof-of-concept with working curl commands is published in the GHSA advisory, so the attack is trivially reproducible for reconnaissance and project-name enumeration.