Summary
James Henstridge discovered that snapd's default apparmor template did
not restrict access to systemd-userdbd varlink interface. A local
attacker could possibly use this issue to obtain sensitive information.
(CVE-2024-5300)
Qualys discovered that snap-confine can be tricked to create
attacker-controlled files at certain privileged locations. A local
attacker could possibly use this issue to bypass intended restrictions
and escalate privileges to root. This issue only affected
Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-8933)
Zygmunt Krynicki discovered that snapd's default seccomp template
did not restrict the creation of executables with the set-user-ID
attribute. A local attacker could possibly use this issue to create
and execute setuid binaries. (CVE-2026-15226)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | snapd | 2.76+ubuntu22.04.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | snapd | 2.76+ubuntu24.04.1 |
| Ubuntu · 26.04 LTS 26.04:LTS | snapd | 2.76+ubuntu26.04.3 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | snapd | 2.61.4ubuntu0.16.04.1+esm4 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | snapd | 2.61.4ubuntu0.18.04.1+esm4 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | snapd | 2.67.1+20.04ubuntu1~esm3 |
Vulnerabilities 3
-
High 8.4
snapd snap-confine Sandbox Confinement Bypass via Omission of setuid Restriction in Seccomp Templates
A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler (snap-confine). The default seccomp security templates generated by the engine to restrict system calls do not filter or reject process ope…
-
High 7.8CVE-2026-8933 Public exploit
snap-confine Local Privilege Escalation via Capabilities Misconfiguration or Flaw in Execution Environment Setup
A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure execution environment for snap applications. This vulnerability uniquely affects versions of snap-c…
-
Medium 5.6
AppArmor Base Profile Misconfiguration in snapd Permits Confined Snaps Unauthorized Access to Hashed Passwords via systemd-userdbd
An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd (inherited via ) inadvertently permit st…