Which versions of qSnapper are affected by EUVD-2026-38272?

qSnapper vulnerability in versions before 1.3.3 enables unprivileged local users to execute administrative snapshot operations without proper authorization.. A patch is available.

How to fix or mitigate EUVD-2026-38272?

24 hours: Identify all systems running qSnapper versions before 1.3.3 and assess criticality of affected systems. 7 days: Apply qSnapper v1.3.3 patch to all affected systems, prioritizing production and sensitive environments; test patches in non-production systems first. 30 days: Complete rollout verification across all infrastructure and validate successful patch installation.

qSnapper EUVD-2026-38272

Q: What is the CVSS score of EUVD-2026-38272?

EUVD-2026-38272 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-41048 HIGH

Incorrect Implementation of Authentication Algorithm (CWE-303)

2026-05-27

GHSA-x7qh-xcf8-p6cq

Apache SSRF Kubernetes Qsnapper

8.4

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Local D-Bus reach gives AV:L; any local user suffices so PR:L; no user interaction; high confidentiality and integrity over snapshots, no availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 22, 2026 - 17:01 EUVD

Source Code Evidence Fetched

Jun 22, 2026 - 16:53 vuln.today

Analysis Generated

Jun 22, 2026 - 16:53 vuln.today

CVSS changed

Jun 22, 2026 - 16:52 NVD

8.4 (HIGH)

CVE Published

May 27, 2026 - 20:45 oss-security

HIGH 8.4

CVE Published

May 27, 2026 - 20:45 nvd

UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Authentication bypass in qSnapper's privileged D-Bus service (versions before 1.3.3) allows any local unprivileged user to invoke administrative snapshot operations by piggy-backing on another client's prior Polkit authentication. The service stored authentication state in a single shared m_authenticated flag rather than per-client, so once any caller passed an admin check, all subsequent D-Bus callers inherited that state. No public exploit identified at time of analysis; the issue was found during a SUSE-coordinated security review and patched in v1.3.3.

Technical ContextAI

qSnapper is a Qt-based front-end and privileged D-Bus backend service for managing Btrfs snapshots (a Snapper-style utility). Its system bus service exposed methods gated by Polkit checks, but the implementation cached the outcome in a process-wide member variable (m_authenticated) plus a custom Authenticate() D-Bus method, instead of evaluating Polkit per-call and per-caller. This is a textbook CWE-303 (Incorrect Implementation of Authentication Algorithm): the auth decision is computed correctly once, then incorrectly reused across distinct security principals. The upstream fix removes the cache and the Authenticate() method entirely and relies on Polkit's native auth_admin_keep behaviour, which scopes recent authorizations to the specific bus name that requested them.

RemediationAI

Upgrade to qSnapper 1.3.3 or later, which removes the shared m_authenticated cache and the Authenticate() D-Bus method and delegates re-authorization to Polkit's auth_admin_keep behavior (release notes: https://github.com/presire/qSnapper/releases/tag/v1.3.3). On SUSE/openSUSE, install the distribution update tracked in https://bugzilla.suse.com/show_bug.cgi?id=1262218 once it lands. If patching must be deferred, mitigate by stopping and masking the qSnapper system D-Bus service (systemctl mask) so the privileged endpoint is unreachable - accepting the trade-off that snapshot management from the GUI will be unavailable - or by tightening the Polkit policy for com.presire.qsnapper actions to auth_admin (forcing a fresh prompt every call) rather than any cached variant; this will produce noticeable extra auth prompts but blocks the cross-client carry-over.