EUVD-2026-23862Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7DescriptionCVE.org
An improper access control vulnerability in the canonical-livepatch snap client prior to version 10.15.0 allows a local unprivileged user to obtain a sensitive, root-level authentication token by sending an unauthenticated request to the livepatchd.sock Unix domain socket. This vulnerability is exploitable on systems where an administrator has already enabled the Livepatch client with a valid Ubuntu Pro subscription. This token allows an attacker to access Livepatch services using the victim's credentials, as well as potentially cause issues to the Livepatch server.
AnalysisAI
Canonical Livepatch snap client prior to 10.15.0 allows local unprivileged users to obtain a root-level authentication token via an unauthenticated request to the livepatchd.sock Unix domain socket, enabling attackers to impersonate the victim and access Livepatch services on systems with an active Ubuntu Pro subscription.
Technical ContextAI
The canonical-livepatch snap implements a Unix domain socket interface (livepatchd.sock) for local inter-process communication with the Livepatch daemon. The vulnerability stems from improper access control (CWE-306) on this socket, which fails to enforce proper authentication or authorization checks. This allows any local unprivileged user to connect to the socket and retrieve a sensitive authentication token normally intended for root-level operations. The token can then be replayed to authenticate requests to Livepatch services, effectively bypassing the intended privilege boundary between the unprivileged user and the root-owned service. The snap containerization model isolates the Livepatch client but does not prevent local socket access from unprivileged users within the system.
RemediationAI
Apply the vendor-released patch by upgrading canonical-livepatch snap to version 10.15.0 or later. Ubuntu users can update via snap refresh canonical-livepatch or through the Ubuntu Software Center. Until patching is completed, disable Livepatch if not critical for your environment by running snap disable canonical-livepatch, or restrict local system access via OS-level controls such as restricting user accounts or removing unnecessary local user access. Note that disabling Livepatch removes live kernel patching capabilities and requires traditional system reboots for kernel updates, which may impact availability requirements. Detailed information and updates are available at https://discourse.ubuntu.com/t/security-notice-canonical-livepatch-client-snap-vulnerability/80662.
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and
An authenticated path traversal vulnerability in Langflow's file upload functionality allows attackers to write arbitrar
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitra
An authorization bypass vulnerability in gRPC-Go allows attackers to circumvent path-based access control by sending HTT
Arbitrary file read in Langroid's SQLChatAgent (<= 0.63.0) lets an attacker who can influence the LLM-generated SQL exfi
An issue was discovered in the jsrsasign package through 8.0.18 for Node.js. Rated high severity (CVSS 7.5), this vulner
The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' byte
Resource exhaustion in OpenTelemetry Go propagation library (v1.41.0 and earlier) enables remote attackers to trigger se
A vulnerability in the seccomp filters of Canonical snapd before version 2.37.4 allows a strict mode snap to insert char
The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved
concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "ca
Timestamp forgery in sigstore-js allows an attacker supplying a crafted bundle v0.2 to manipulate certificate validity w
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today