{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"lxd","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":[],"id":"tcs_01M5NW4QBP6EWHCXW6H294KD8M","modified_at":"2026-10-04T00:00:12.437760027Z","published_at":"2026-09-28T14:17:21.427Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-87799","https://security-tracker.debian.org/tracker/CVE-2026-87799"],"severity":{"label":"critical","score":9.9},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-87799#Debian:13/lxd","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-87799"}],"summary":"Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client that can create instan"}