{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"lxd","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":[],"id":"tcs_01M5NW4PMNZE7N8FSW70CVBHXT","modified_at":"2026-10-04T00:00:12.129360285Z","published_at":"2026-09-28T14:17:21.290Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-87798","https://security-tracker.debian.org/tracker/CVE-2026-87798"],"severity":{"label":"medium","score":5.8},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-87798","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-87798"}],"summary":"Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 (fixed in 4.0.14, 5.0.10 and 5.21.8) on Linux allows an attacker with root a"}