EUVD-2026-46262
GHSA-fxqr-j4gx-622c
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector and low-privileged local account required (AV:L/PR:L), no interaction, and successful escalation yields full root so C/I/A all High; scope unchanged as it stays on the same host.
Primary rating from Vendor (canonical).
CVSS VectorVendor: canonical
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure execution environment for snap applications. This vulnerability uniquely affects versions of snap-confine configured with set-capabilities (rather than standard set-uid-root installations). Due to a flaw in how privilege boundaries or security sandboxes are initialized when the binary runs under limited ambient capabilities, a local, unprivileged attacker can exploit this behavior to bypass intended restrictions and execute arbitrary code. Successful exploitation allows the local user to elevate their privileges to full root authority.
AnalysisAI
Local privilege escalation in snap-confine - the SUID/set-capabilities helper snapd uses to build the confinement sandbox for snap applications - lets an unprivileged local user on Ubuntu 22.04, 24.04, and 26.04 LTS gain full root. The flaw only manifests where snap-confine is deployed with file capabilities (set-capabilities) instead of the traditional set-uid-root binary, where incorrect handling of ambient capabilities lets an attacker escape intended privilege boundaries and run arbitrary code as root. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) an existing local, unprivileged account with the ability to execute snap-confine or launch a snap application, and (2) snap-confine deployed in the non-default set-capabilities configuration - the description states the vulnerability 'uniquely affects versions of snap-confine configured with set-capabilities (rather than standard set-uid-root installations)', so that configuration IS the required precondition. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High) is internally consistent with the description: a local, low-privileged user with a normal shell account achieves full root (C/I/A all High), with low attack complexity and no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who already holds an ordinary unprivileged shell on an Ubuntu LTS host - for example via a compromised web-app service account or a low-privileged SSH login - invokes snap-confine (directly or through launching a snap) on a system where it is installed with set-capabilities. By manipulating the ambient/limited capability context during sandbox setup, they cause snap-confine to leave root-equivalent privileges reachable and execute code as root. … |
| Remediation | Patch available per vendor advisory: apply the snapd/snap-confine security update for your Ubuntu release (22.04, 24.04, or 26.04 LTS) via the normal package channel (e.g. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Ubuntu 22.04, 24.04, and 26.04 LTS systems running snap applications and determine their snap-confine deployment method (file capabilities vs. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ubuntu 26 04 Lts
View allRoot-level remote code execution in Canonical's ubuntu-pro-client (formerly ubuntu-advantage-tools) allows an attacker w
TLS trust store poisoning in Canonical ADSys through v0.16.2 allows a network-positioned attacker to inject an arbitrary
Sandbox confinement bypass in Canonical snapd (snap-confine) affects all supported Ubuntu LTS releases (16.04 through 26
ubuntu-pro-client (formerly ubuntu-advantage-tools) leaks Ubuntu Pro bearer tokens to unprivileged local users via the L
Insecure symlink following in Canonical's ubuntu-pro-client `pro collect-logs` command allows a low-privileged local att
Same weakness CWE-250 – Execution with Unnecessary Privileges
View allShare
External POC / Exploit Code
Leaving vuln.today