Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-15226 (GCVE-0-2026-15226)

Vulnerability from nvd – Published: 2026-07-21 14:02 – Updated: 2026-07-22 18:28

Title

snapd snap-confine Sandbox Confinement Bypass via Omission of setuid Restriction in Seccomp Templates

Summary

A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler (snap-confine). The default seccomp security templates generated by the engine to restrict system calls do not filter or reject process operations capable of creating or manipulating file execution flags with set-user-ID attributes. Consequently, an application running within a strictly confined snap environment can successfully compile or drop binaries and apply setuid properties to them. If a compromised or malicious process inside the snap sandbox executes these generated setuid binaries, it can potentially circumvent architectural sandboxing assumptions, drop intended restriction policies, or execute privileged actions inside the container namespace that should otherwise be strictly blocked. The vulnerability has been resolved by hardening the seccomp template engine to block the execution and creation of setuid executables by sandboxed snap processes.

Severity

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-22 18:15 UTC

CWE

CWE-250 - Execution with unnecessary privileges

Assigner

canonical mitre root

References

1 reference

URL	Tags
https://ubuntu.com/security/CVE-2026-15226	vdb-entryissue-tracking

Impacted products

7 products

Vendor	Product	Version
		Affected: 0 , < 2.76.1 (semver)
Canonical	Ubuntu 26.04 LTS	Unaffected: 2.76+ubuntu26.04.3 (dpkg)
Canonical	Ubuntu 24.04 LTS	Unaffected: 2.76+ubuntu24.04.1 (dpkg)
Canonical	Ubuntu 22.04 LTS	Unaffected: 2.76+ubuntu22.04.1 (dpkg)
Canonical	Ubuntu 20.04 LTS	Unaffected: 2.67.1+20.04ubuntu1~esm2 (dpkg)
Canonical	Ubuntu 18.04 LTS	Unaffected: 2.61.4ubuntu0.18.04.1+esm3 (dpkg)
Canonical	Ubuntu 16.04 LTS	Unaffected: 2.61.4ubuntu0.16.04.1+esm3

Date Public

2026-07-21 14:00

Credits

Zygmunt Krynicki

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15226",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T18:15:09.916257Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T18:28:11.440Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/canonical",
          "defaultStatus": "unaffected",
          "packageName": "snapd",
          "repo": "https://github.com/canonical/snapd/",
          "versions": [
            {
              "lessThan": "2.76.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/resolute",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 26.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.76+ubuntu26.04.3",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/noble",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 24.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.76+ubuntu24.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/jammy",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 22.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.76+ubuntu22.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/focal",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 20.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.67.1+20.04ubuntu1~esm2",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/bionic",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 18.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.61.4ubuntu0.18.04.1+esm3",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/xenial",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 16.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.61.4ubuntu0.16.04.1+esm3"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zygmunt Krynicki"
        }
      ],
      "datePublic": "2026-07-21T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler (snap-confine). The default seccomp security templates generated by the engine to restrict system calls do not filter or reject process operations capable of creating or manipulating file execution flags with set-user-ID attributes.  Consequently, an application running within a strictly confined snap environment can successfully compile or drop binaries and apply setuid properties to them. If a compromised or malicious process inside the snap sandbox executes these generated setuid binaries, it can potentially circumvent architectural sandboxing assumptions, drop intended restriction policies, or execute privileged actions inside the container namespace that should otherwise be strictly blocked. The vulnerability has been resolved by hardening the seccomp template engine to block the execution and creation of setuid executables by sandboxed snap processes."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-122",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-122 Privilege Abuse"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-250",
              "description": "CWE-250 Execution with unnecessary privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T14:02:04.071Z",
        "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
        "shortName": "canonical"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "issue-tracking"
          ],
          "url": "https://ubuntu.com/security/CVE-2026-15226"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "snapd snap-confine Sandbox Confinement Bypass via Omission of setuid Restriction in Seccomp Templates"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
    "assignerShortName": "canonical",
    "cveId": "CVE-2026-15226",
    "datePublished": "2026-07-21T14:02:04.071Z",
    "dateReserved": "2026-07-09T10:14:23.078Z",
    "dateUpdated": "2026-07-22T18:28:11.440Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-5300 (GCVE-0-2024-5300)

Vulnerability from nvd – Published: 2026-07-21 14:00 – Updated: 2026-07-22 18:28

Title

AppArmor Base Profile Misconfiguration in snapd Permits Confined Snaps Unauthorized Access to Hashed Passwords via systemd-userdbd

Summary

An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd (inherited via ) inadvertently permit strictly confined snap applications, which lack the privileged account-control interface, to interact directly with the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets under /run/systemd/userdb/. On systems where the systemd-userdbd service is installed and operational, the service fails to distinguish between an unconfined root user on the host system and a restricted root user running within a snap application's sandbox (such as a daemon or configuration hook). Because systemd-userdbd returns "complete" user records—including sensitive hashed user passwords from /etc/shadow—when queried by a process running as root, a compromised or malicious strictly confined snap executing code as root can successfully query the Varlink interface to retrieve all system password hashes, bypassing intended snap sandbox restrictions. This issue is mitigated by the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments.

Severity

5.6 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-22 18:13 UTC

CWE

CWE-212 - Improper removal of sensitive information before storage or transfer

Assigner

canonical mitre root

References

1 reference

URL	Tags
https://ubuntu.com/security/CVE-2024-5300	vdb-entryissue-tracking

Impacted products

7 products

Vendor	Product	Version
		Affected: 0 , < 2.76.1 (semver)
Canonical	Ubuntu 26.04 LTS	Unaffected: 2.76+ubuntu26.04.3 (dpkg)
Canonical	Ubuntu 24.04 LTS	Unaffected: 2.76+ubuntu24.04.1 (dpkg)
Canonical	Ubuntu 22.04 LTS	Unaffected: 2.76+ubuntu22.04.1 (dpkg)
Canonical	Ubuntu 20.04 LTS	Unaffected: 2.67.1+20.04ubuntu1~esm2 (dpkg)
Canonical	Ubuntu 18.04 LTS	Unaffected: 2.61.4ubuntu0.18.04.1+esm3 (dpkg)
Canonical	Ubuntu 16.04 LTS	Unaffected: 2.61.4ubuntu0.16.04.1+esm3

Date Public

2026-07-21 14:00

Credits

James Henstridge

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-5300",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T18:13:29.966474Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T18:28:16.818Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/canonical",
          "defaultStatus": "unaffected",
          "packageName": "snapd",
          "repo": "https://github.com/canonical/snapd/",
          "versions": [
            {
              "lessThan": "2.76.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/resolute",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 26.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.76+ubuntu26.04.3",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/noble",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 24.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.76+ubuntu24.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/jammy",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 22.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.76+ubuntu22.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/focal",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 20.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.67.1+20.04ubuntu1~esm2",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/bionic",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 18.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.61.4ubuntu0.18.04.1+esm3",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/xenial",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 16.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.61.4ubuntu0.16.04.1+esm3"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "James Henstridge"
        }
      ],
      "datePublic": "2026-07-21T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd (inherited via ) inadvertently permit strictly confined snap applications, which lack the privileged account-control interface, to interact directly with the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets under /run/systemd/userdb/.\nOn systems where the systemd-userdbd service is installed and operational, the service fails to distinguish between an unconfined root user on the host system and a restricted root user running within a snap application\u0027s sandbox (such as a daemon or configuration hook). Because systemd-userdbd returns \"complete\" user records\u2014including sensitive hashed user passwords from /etc/shadow\u2014when queried by a process running as root, a compromised or malicious strictly confined snap executing code as root can successfully query the Varlink interface to retrieve all system password hashes, bypassing intended snap sandbox restrictions. This issue is mitigated by the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-212",
              "description": "CWE-212 Improper removal of sensitive information before storage or transfer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T14:00:51.066Z",
        "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
        "shortName": "canonical"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "issue-tracking"
          ],
          "url": "https://ubuntu.com/security/CVE-2024-5300"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "AppArmor Base Profile Misconfiguration in snapd Permits Confined Snaps Unauthorized Access to Hashed Passwords via systemd-userdbd"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
    "assignerShortName": "canonical",
    "cveId": "CVE-2024-5300",
    "datePublished": "2026-07-21T14:00:51.066Z",
    "dateReserved": "2024-05-23T21:58:22.809Z",
    "dateUpdated": "2026-07-22T18:28:16.818Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-9494 (GCVE-0-2026-9494)

Vulnerability from nvd – Published: 2026-07-16 12:12 – Updated: 2026-07-16 15:11

Title

ubuntu-pro-client Information Disclosure via Cleartext Bearer Token Exposure in Process Command Line

Summary

An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:<token>@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token directly from /proc/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-16 13:36 UTC

CWE

CWE-214 - Invocation of process using visible sensitive information

Assigner

canonical mitre root

References

1 reference

URL	Tags
https://ubuntu.com/security/CVE-2026-9494	vdb-entry

Impacted products

8 products

Vendor	Product	Version
Canonical	ubuntu-pro-client (ubuntu-advantage-tools)	Affected: 0 , < 37.3 (python)
Canonical	Ubuntu 26.04 LTS	Unaffected: 37.2ubuntu0.1 (dpkg)
Canonical	Ubuntu 24.04 LTS	Unaffected: 37.2ubuntu~24.04.1 (dpkg)
Canonical	Ubuntu 22.04 LTS	Unaffected: 37.2ubuntu~22.04.1 (dpkg)
Canonical	Ubuntu 20.04 LTS	Unaffected: 37.1ubuntu0~20.04.1 (dpkg)
Canonical	Ubuntu 18.04 LTS	Unaffected: 37.1ubuntu0~18.04.1 (dpkg)
Canonical	Ubuntu 16.04 LTS	Unaffected: 37.1ubuntu0~16.04.1 (dpkg)
Canonical	Ubuntu 14.04 LTS	Unaffected: 19.7ubuntu0.1 (dpkg)

Date Public

2026-07-16 12:00

Credits

Bilal Teke

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9494",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-16T13:36:06.361605Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-16T15:11:07.229Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/canonical/",
          "defaultStatus": "unaffected",
          "packageName": "ubuntu-pro-client",
          "platforms": [
            "Linux"
          ],
          "product": "ubuntu-pro-client (ubuntu-advantage-tools)",
          "repo": "https://github.com/canonical/ubuntu-pro-client",
          "vendor": "Canonical",
          "versions": [
            {
              "lessThan": "37.3",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/resolute",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 26.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.2ubuntu0.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/noble",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 24.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.2ubuntu~24.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/jammy",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 22.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.2ubuntu~22.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/focal",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 20.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.1ubuntu0~20.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/bionic",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 18.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.1ubuntu0~18.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/xenial",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 16.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.1ubuntu0~16.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/trusty",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 14.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "19.7ubuntu0.1",
              "versionType": "dpkg"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Bilal Teke"
        }
      ],
      "datePublic": "2026-07-16T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An information disclosure vulnerability exists in Canonical ubuntu-pro-client\u003cbr\u003e(formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT\u003cbr\u003ecredentials by executing /usr/lib/apt/apt-helper using the download-file\u003cbr\u003ecommand. During this process, the secret bearer token is embedded directly in\u003cbr\u003ethe cleartext URL component passed via the command-line arguments (argv),\u003cbr\u003eresulting in a URL format such as https://bearer:\u003ctoken\u003e@esm.ubuntu.com/.../.\u003cbr\u003eOn systems utilizing a default-mounted /proc file system where process-hiding\u003cbr\u003emitigations (such as hidepid) are disabled, an unprivileged local attacker can\u003cbr\u003emonitor system processes and read the sensitive bearer token directly from\u003cbr\u003e/proc/cmdline while the helper process is actively running. This leaked\u003cbr\u003etoken can subsequently be used to gain unauthorized access to the victim\u0027s\u003cbr\u003eUbuntu Pro or Expanded Security Maintenance (ESM) repositories.\u003cbr\u003e"
            }
          ],
          "value": "An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in\nthe cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:\u003ctoken\u003e@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can\nmonitor system processes and read the sensitive bearer token directly from /proc/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim\u0027s Ubuntu Pro or Expanded Security Maintenance (ESM) repositories."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-13",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-13 Subverting Environment Variable Values"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-214",
              "description": "CWE-214 Invocation of process using visible sensitive information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-16T12:12:27.447Z",
        "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
        "shortName": "canonical"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://ubuntu.com/security/CVE-2026-9494"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "ubuntu-pro-client Information Disclosure via Cleartext Bearer Token Exposure in Process Command Line"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
    "assignerShortName": "canonical",
    "cveId": "CVE-2026-9494",
    "datePublished": "2026-07-16T12:12:27.447Z",
    "dateReserved": "2026-05-25T08:23:24.573Z",
    "dateUpdated": "2026-07-16T15:11:07.229Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-12391 (GCVE-0-2026-12391)

Vulnerability from nvd – Published: 2026-07-16 12:17 – Updated: 2026-07-16 13:28

Title

ubuntu-pro-client Local Privilege Escalation and Information Disclosure via Symlink Arbitrary File Read in collect-logs

Summary

An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets.

Severity

5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-16 13:20 UTC

CWE

CWE-59 - Improper link resolution before file access ('link following')

Assigner

canonical mitre root

References

1 reference

URL	Tags
https://ubuntu.com/security/CVE-2026-12391	vdb-entry

Impacted products

7 products

Vendor	Product	Version
Canonical	ubuntu-pro-client (ubuntu-advantage-tools)	Affected: 0 , < 37.3 (python)
Canonical	Ubuntu 26.04 LTS	Unaffected: 37.2ubuntu0.1 (dpkg)
Canonical	Ubuntu 24.04 LTS	Unaffected: 37.2ubuntu~24.04.1 (dpkg)
Canonical	Ubuntu 22.04 LTS	Unaffected: 37.2ubuntu~22.04.1 (dpkg)
Canonical	Ubuntu 20.04 LTS	Unaffected: 37.1ubuntu0~20.04.1 (dpkg)
Canonical	Ubuntu 18.04 LTS	Unaffected: 37.1ubuntu0~18.04.1 (dpkg)
Canonical	Ubuntu 16.04 LTS	Unaffected: 37.1ubuntu0~16.04.1 (dpkg)

Date Public

2026-07-16 12:00

Credits

Mateusz Gierblinski

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-12391",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-16T13:20:30.714803Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-16T13:28:19.156Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/canonical/",
          "defaultStatus": "unaffected",
          "packageName": "ubuntu-pro-client",
          "platforms": [
            "Linux"
          ],
          "product": "ubuntu-pro-client (ubuntu-advantage-tools)",
          "repo": "https://github.com/canonical/ubuntu-pro-client",
          "vendor": "Canonical",
          "versions": [
            {
              "lessThan": "37.3",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/resolute",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 26.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.2ubuntu0.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/noble",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 24.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.2ubuntu~24.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/jammy",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 22.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.2ubuntu~22.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/focal",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 20.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.1ubuntu0~20.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/bionic",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 18.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.1ubuntu0~18.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/xenial",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 16.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.1ubuntu0~16.04.1",
              "versionType": "dpkg"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mateusz Gierblinski"
        }
      ],
      "datePublic": "2026-07-16T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An insecure symlink following vulnerability exists in Canonical\u003cbr\u003eubuntu-pro-client (formerly ubuntu-advantage-tools) within the\u003cbr\u003epro collect-logs command framework. The utility creates or utilizes\u003cbr\u003epredictable temporary file paths or user-accessible log directories when\u003cbr\u003egathering diagnostic information without verifying the file type or ownership.\u003cbr\u003eAn unprivileged local attacker can exploit this behavior by creating a\u003cbr\u003esymbolic link (symlink) at a predictable destination path pointing to an\u003cbr\u003earbitrary, root-readable file (such as /etc/shadow or private files within\u003cbr\u003e/root).\u003cbr\u003eWhen a root administrator or operator subsequently executes the\u003cbr\u003epro collect-logs command, the tool follows the user-controlled symlink, reads\u003cbr\u003ethe target file, and compresses its contents into the resulting diagnostic\u003cbr\u003esupport archive. Because the output archive remains readable by the\u003cbr\u003eunprivileged user, the attacker can extract and read the sensitive root-owned\u003cbr\u003efiles, leading to a complete information disclosure of system secrets.\u003cbr\u003e"
            }
          ],
          "value": "An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-132",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-132 Symlink Attack"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59 Improper link resolution before file access (\u0027link following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-16T12:17:01.094Z",
        "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
        "shortName": "canonical"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://ubuntu.com/security/CVE-2026-12391"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "ubuntu-pro-client Local Privilege Escalation and Information Disclosure via Symlink Arbitrary File Read in collect-logs"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
    "assignerShortName": "canonical",
    "cveId": "CVE-2026-12391",
    "datePublished": "2026-07-16T12:17:01.094Z",
    "dateReserved": "2026-06-16T12:15:12.153Z",
    "dateUpdated": "2026-07-16T13:28:19.156Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-11386 (GCVE-0-2026-11386)

Vulnerability from nvd – Published: 2026-07-16 12:16 – Updated: 2026-07-16 13:31

Title

ubuntu-pro-client Input Validation Vulnerability Leading to Arbitrary APT Directive Injection and Remote Code Execution

Summary

An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.

Severity

9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-16 13:30 UTC

CWE

CWE-20 - Improper input validation

Assigner

canonical mitre root

References

1 reference

URL	Tags
https://ubuntu.com/security/CVE-2026-11386	vdb-entry

Impacted products

8 products

Vendor	Product	Version
Canonical	ubuntu-pro-client (ubuntu-advantage-tools)	Affected: 0 , < 37.3 (python)
Canonical	Ubuntu 26.04 LTS	Unaffected: 37.2ubuntu0.1 (dpkg)
Canonical	Ubuntu 24.04 LTS	Unaffected: 37.2ubuntu~24.04.1 (dpkg)
Canonical	Ubuntu 22.04 LTS	Unaffected: 37.2ubuntu~22.04.1 (dpkg)
Canonical	Ubuntu 20.04 LTS	Unaffected: 37.1ubuntu0~20.04.1 (dpkg)
Canonical	Ubuntu 18.04 LTS	Unaffected: 37.1ubuntu0~18.04.1 (dpkg)
Canonical	Ubuntu 16.04 LTS	Unaffected: 37.1ubuntu0~16.04.1 (dpkg)
Canonical	Ubuntu 14.04 LTS	Unaffected: 19.7ubuntu0.1 (dpkg)

Date Public

2026-07-16 12:00

Credits

Frederick Jerusha

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-11386",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-16T13:30:45.443694Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-16T13:31:16.910Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/canonical/",
          "defaultStatus": "unaffected",
          "packageName": "ubuntu-pro-client",
          "platforms": [
            "Linux"
          ],
          "product": "ubuntu-pro-client (ubuntu-advantage-tools)",
          "repo": "https://github.com/canonical/ubuntu-pro-client",
          "vendor": "Canonical",
          "versions": [
            {
              "lessThan": "37.3",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/resolute",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 26.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.2ubuntu0.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/noble",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 24.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.2ubuntu~24.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/jammy",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 22.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.2ubuntu~22.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/focal",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 20.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.1ubuntu0~20.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/bionic",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 18.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.1ubuntu0~18.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/xenial",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 16.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.1ubuntu0~16.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/trusty",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 14.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "19.7ubuntu0.1",
              "versionType": "dpkg"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Frederick Jerusha"
        }
      ],
      "datePublic": "2026-07-16T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An input validation and injection vulnerability exists in Canonical\u003cbr\u003eubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs\u003cbr\u003eAPT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their\u003cbr\u003eDEB822 equivalents) using data received directly from the contract server\u003cbr\u003eresponse via the directives.suites[] and directives.aptURL fields. Because\u003cbr\u003ethe client utilizes Python\u0027s str.format() to write these files without\u003cbr\u003eperforming escaping, validation, or newline character filtering, a malicious\u003cbr\u003eor tampered contract response containing embedded newline (\\n) characters can\u003cbr\u003esuccessfully inject arbitrary, attacker-controlled deb configuration lines into\u003cbr\u003eroot-owned APT sources.\u003cbr\u003eWhen combined with the unvalidated additionalPackages[] field\u2014which is passed\u003cbr\u003epositionally into a root-executed apt-get install command\u2014an attacker capable of\u003cbr\u003espoofing or manipulating the contract response (e.g., via a compromised internal\u003cbr\u003einfrastructure, an intercepted connection utilizing a trusted CA, or local logical\u003cbr\u003ebugs) can force the client to fetch and install malicious packages. This ultimately\u003cbr\u003eleads to arbitrary code execution with root privileges on the affected system. This\u003cbr\u003ecomponent is preinstalled on supported Ubuntu Server releases and auto-attaches by\u003cbr\u003edefault on cloud provider Ubuntu Pro images."
            }
          ],
          "value": "An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python\u0027s str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field\u2014which is passed positionally into a root-executed apt-get install command\u2014an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-242",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-242 Code Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper input validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-16T12:16:02.508Z",
        "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
        "shortName": "canonical"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://ubuntu.com/security/CVE-2026-11386"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "ubuntu-pro-client Input Validation Vulnerability Leading to Arbitrary APT Directive Injection and Remote Code Execution"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
    "assignerShortName": "canonical",
    "cveId": "CVE-2026-11386",
    "datePublished": "2026-07-16T12:16:02.508Z",
    "dateReserved": "2026-06-05T15:11:57.169Z",
    "dateUpdated": "2026-07-16T13:31:16.910Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-3888 (GCVE-0-2026-3888)

Vulnerability from nvd – Published: 2026-03-17 14:02 – Updated: 2026-03-18 08:59

Title

Local Privilege Escalation in snapd

Summary

Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-17 00:00 UTC

CWE

CWE-268 - Privilege chaining

Assigner

canonical mitre root

References

6 references

URL	Tags
https://ubuntu.com/security/CVE-2026-3888	vdb-entryissue-tracking
https://ubuntu.com/security/notices/USN-8102-1	vendor-advisory
https://discourse.ubuntu.com/t/snapd-local-privil…	technical-descriptionvendor-advisory
https://blog.qualys.com/vulnerabilities-threat-re…	technical-descriptionmedia-coverage
https://cdn2.qualys.com/advisory/2026/03/17/snap-…	technical-descriptionmedia-coverage
http://www.openwall.com/lists/oss-security/2026/03/18/1

Impacted products

6 products

Vendor	Product	Version
		Affected: 0 , < 2.75.1 (semver)
Canonical	Ubuntu 16.04 LTS	Unaffected: 2.61.4ubuntu0.16.04.1+esm2 , < * (dpkg)
Canonical	Ubuntu 18.04 LTS	Unaffected: 2.61.4ubuntu0.18.04.1+esm2 , < * (dpkg)
Canonical	Ubuntu 20.04 LTS	Unaffected: 2.67.1+20.04ubuntu1~esm1 , < * (dpkg)
Canonical	Ubuntu 22.04 LTS	Unaffected: 2.73+ubuntu22.04.1 , < * (dpkg)
Canonical	Ubuntu 24.04 LTS	Unaffected: 2.73+ubuntu24.04.2 , < * (dpkg)

Date Public

2026-03-17 14:00

Credits

Qualys Security Advisory Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-3888",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-17T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-18T03:55:45.787Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-03-18T03:02:10.640Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/03/18/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/canonical",
          "defaultStatus": "unaffected",
          "packageName": "snapd",
          "repo": "https://github.com/canonical/snapd/",
          "versions": [
            {
              "lessThan": "2.75.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/xenial",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 16.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.61.4ubuntu0.16.04.1+esm2",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/bionic",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 18.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.61.4ubuntu0.18.04.1+esm2",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/focal",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 20.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.67.1+20.04ubuntu1~esm1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/jammy",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 22.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.73+ubuntu22.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/noble",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 24.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.73+ubuntu24.04.2",
              "versionType": "dpkg"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Qualys Security Advisory Team"
        }
      ],
      "datePublic": "2026-03-17T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap\u0027s private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-268",
              "description": "CWE-268 Privilege chaining",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-18T08:59:07.522Z",
        "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
        "shortName": "canonical"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "issue-tracking"
          ],
          "url": "https://ubuntu.com/security/CVE-2026-3888"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://ubuntu.com/security/notices/USN-8102-1"
        },
        {
          "tags": [
            "technical-description",
            "vendor-advisory"
          ],
          "url": "https://discourse.ubuntu.com/t/snapd-local-privilege-escalation-cve-2026-3888"
        },
        {
          "tags": [
            "technical-description",
            "media-coverage"
          ],
          "url": "https://blog.qualys.com/vulnerabilities-threat-research/2026/03/17/cve-2026-3888-important-snap-flaw-enables-local-privilege-escalation-to-root"
        },
        {
          "tags": [
            "technical-description",
            "media-coverage"
          ],
          "url": "https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-systemd-tmpfiles.txt"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Local Privilege Escalation in snapd"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
    "assignerShortName": "canonical",
    "cveId": "CVE-2026-3888",
    "datePublished": "2026-03-17T14:02:08.475Z",
    "dateReserved": "2026-03-10T16:03:08.583Z",
    "dateUpdated": "2026-03-18T08:59:07.522Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15226 (GCVE-0-2026-15226)

Vulnerability from cvelistv5 – Published: 2026-07-21 14:02 – Updated: 2026-07-22 18:28

Title

snapd snap-confine Sandbox Confinement Bypass via Omission of setuid Restriction in Seccomp Templates

Summary

A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler (snap-confine). The default seccomp security templates generated by the engine to restrict system calls do not filter or reject process operations capable of creating or manipulating file execution flags with set-user-ID attributes. Consequently, an application running within a strictly confined snap environment can successfully compile or drop binaries and apply setuid properties to them. If a compromised or malicious process inside the snap sandbox executes these generated setuid binaries, it can potentially circumvent architectural sandboxing assumptions, drop intended restriction policies, or execute privileged actions inside the container namespace that should otherwise be strictly blocked. The vulnerability has been resolved by hardening the seccomp template engine to block the execution and creation of setuid executables by sandboxed snap processes.

Severity

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-22 18:15 UTC

CWE

CWE-250 - Execution with unnecessary privileges

Assigner

canonical mitre root

References

1 reference

URL	Tags
https://ubuntu.com/security/CVE-2026-15226	vdb-entryissue-tracking

Impacted products

7 products

Vendor	Product	Version
		Affected: 0 , < 2.76.1 (semver)
Canonical	Ubuntu 26.04 LTS	Unaffected: 2.76+ubuntu26.04.3 (dpkg)
Canonical	Ubuntu 24.04 LTS	Unaffected: 2.76+ubuntu24.04.1 (dpkg)
Canonical	Ubuntu 22.04 LTS	Unaffected: 2.76+ubuntu22.04.1 (dpkg)
Canonical	Ubuntu 20.04 LTS	Unaffected: 2.67.1+20.04ubuntu1~esm2 (dpkg)
Canonical	Ubuntu 18.04 LTS	Unaffected: 2.61.4ubuntu0.18.04.1+esm3 (dpkg)
Canonical	Ubuntu 16.04 LTS	Unaffected: 2.61.4ubuntu0.16.04.1+esm3

Date Public

2026-07-21 14:00

Credits

Zygmunt Krynicki

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15226",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T18:15:09.916257Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T18:28:11.440Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/canonical",
          "defaultStatus": "unaffected",
          "packageName": "snapd",
          "repo": "https://github.com/canonical/snapd/",
          "versions": [
            {
              "lessThan": "2.76.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/resolute",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 26.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.76+ubuntu26.04.3",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/noble",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 24.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.76+ubuntu24.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/jammy",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 22.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.76+ubuntu22.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/focal",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 20.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.67.1+20.04ubuntu1~esm2",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/bionic",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 18.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.61.4ubuntu0.18.04.1+esm3",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/xenial",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 16.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.61.4ubuntu0.16.04.1+esm3"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zygmunt Krynicki"
        }
      ],
      "datePublic": "2026-07-21T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler (snap-confine). The default seccomp security templates generated by the engine to restrict system calls do not filter or reject process operations capable of creating or manipulating file execution flags with set-user-ID attributes.  Consequently, an application running within a strictly confined snap environment can successfully compile or drop binaries and apply setuid properties to them. If a compromised or malicious process inside the snap sandbox executes these generated setuid binaries, it can potentially circumvent architectural sandboxing assumptions, drop intended restriction policies, or execute privileged actions inside the container namespace that should otherwise be strictly blocked. The vulnerability has been resolved by hardening the seccomp template engine to block the execution and creation of setuid executables by sandboxed snap processes."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-122",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-122 Privilege Abuse"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-250",
              "description": "CWE-250 Execution with unnecessary privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T14:02:04.071Z",
        "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
        "shortName": "canonical"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "issue-tracking"
          ],
          "url": "https://ubuntu.com/security/CVE-2026-15226"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "snapd snap-confine Sandbox Confinement Bypass via Omission of setuid Restriction in Seccomp Templates"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
    "assignerShortName": "canonical",
    "cveId": "CVE-2026-15226",
    "datePublished": "2026-07-21T14:02:04.071Z",
    "dateReserved": "2026-07-09T10:14:23.078Z",
    "dateUpdated": "2026-07-22T18:28:11.440Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-5300 (GCVE-0-2024-5300)

Vulnerability from cvelistv5 – Published: 2026-07-21 14:00 – Updated: 2026-07-22 18:28

Title

AppArmor Base Profile Misconfiguration in snapd Permits Confined Snaps Unauthorized Access to Hashed Passwords via systemd-userdbd

Summary

An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd (inherited via ) inadvertently permit strictly confined snap applications, which lack the privileged account-control interface, to interact directly with the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets under /run/systemd/userdb/. On systems where the systemd-userdbd service is installed and operational, the service fails to distinguish between an unconfined root user on the host system and a restricted root user running within a snap application's sandbox (such as a daemon or configuration hook). Because systemd-userdbd returns "complete" user records—including sensitive hashed user passwords from /etc/shadow—when queried by a process running as root, a compromised or malicious strictly confined snap executing code as root can successfully query the Varlink interface to retrieve all system password hashes, bypassing intended snap sandbox restrictions. This issue is mitigated by the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments.

Severity

5.6 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-22 18:13 UTC

CWE

CWE-212 - Improper removal of sensitive information before storage or transfer

Assigner

canonical mitre root

References

1 reference

URL	Tags
https://ubuntu.com/security/CVE-2024-5300	vdb-entryissue-tracking

Impacted products

7 products

Vendor	Product	Version
		Affected: 0 , < 2.76.1 (semver)
Canonical	Ubuntu 26.04 LTS	Unaffected: 2.76+ubuntu26.04.3 (dpkg)
Canonical	Ubuntu 24.04 LTS	Unaffected: 2.76+ubuntu24.04.1 (dpkg)
Canonical	Ubuntu 22.04 LTS	Unaffected: 2.76+ubuntu22.04.1 (dpkg)
Canonical	Ubuntu 20.04 LTS	Unaffected: 2.67.1+20.04ubuntu1~esm2 (dpkg)
Canonical	Ubuntu 18.04 LTS	Unaffected: 2.61.4ubuntu0.18.04.1+esm3 (dpkg)
Canonical	Ubuntu 16.04 LTS	Unaffected: 2.61.4ubuntu0.16.04.1+esm3

Date Public

2026-07-21 14:00

Credits

James Henstridge

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-5300",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T18:13:29.966474Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T18:28:16.818Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/canonical",
          "defaultStatus": "unaffected",
          "packageName": "snapd",
          "repo": "https://github.com/canonical/snapd/",
          "versions": [
            {
              "lessThan": "2.76.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/resolute",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 26.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.76+ubuntu26.04.3",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/noble",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 24.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.76+ubuntu24.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/jammy",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 22.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.76+ubuntu22.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/focal",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 20.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.67.1+20.04ubuntu1~esm2",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/bionic",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 18.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.61.4ubuntu0.18.04.1+esm3",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/xenial",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 16.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.61.4ubuntu0.16.04.1+esm3"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "James Henstridge"
        }
      ],
      "datePublic": "2026-07-21T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd (inherited via ) inadvertently permit strictly confined snap applications, which lack the privileged account-control interface, to interact directly with the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets under /run/systemd/userdb/.\nOn systems where the systemd-userdbd service is installed and operational, the service fails to distinguish between an unconfined root user on the host system and a restricted root user running within a snap application\u0027s sandbox (such as a daemon or configuration hook). Because systemd-userdbd returns \"complete\" user records\u2014including sensitive hashed user passwords from /etc/shadow\u2014when queried by a process running as root, a compromised or malicious strictly confined snap executing code as root can successfully query the Varlink interface to retrieve all system password hashes, bypassing intended snap sandbox restrictions. This issue is mitigated by the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-212",
              "description": "CWE-212 Improper removal of sensitive information before storage or transfer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T14:00:51.066Z",
        "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
        "shortName": "canonical"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "issue-tracking"
          ],
          "url": "https://ubuntu.com/security/CVE-2024-5300"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "AppArmor Base Profile Misconfiguration in snapd Permits Confined Snaps Unauthorized Access to Hashed Passwords via systemd-userdbd"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
    "assignerShortName": "canonical",
    "cveId": "CVE-2024-5300",
    "datePublished": "2026-07-21T14:00:51.066Z",
    "dateReserved": "2024-05-23T21:58:22.809Z",
    "dateUpdated": "2026-07-22T18:28:16.818Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-12391 (GCVE-0-2026-12391)

Vulnerability from cvelistv5 – Published: 2026-07-16 12:17 – Updated: 2026-07-16 13:28

Title

ubuntu-pro-client Local Privilege Escalation and Information Disclosure via Symlink Arbitrary File Read in collect-logs

Summary

An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets.

Severity

5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-16 13:20 UTC

CWE

CWE-59 - Improper link resolution before file access ('link following')

Assigner

canonical mitre root

References

1 reference

URL	Tags
https://ubuntu.com/security/CVE-2026-12391	vdb-entry

Impacted products

7 products

Vendor	Product	Version
Canonical	ubuntu-pro-client (ubuntu-advantage-tools)	Affected: 0 , < 37.3 (python)
Canonical	Ubuntu 26.04 LTS	Unaffected: 37.2ubuntu0.1 (dpkg)
Canonical	Ubuntu 24.04 LTS	Unaffected: 37.2ubuntu~24.04.1 (dpkg)
Canonical	Ubuntu 22.04 LTS	Unaffected: 37.2ubuntu~22.04.1 (dpkg)
Canonical	Ubuntu 20.04 LTS	Unaffected: 37.1ubuntu0~20.04.1 (dpkg)
Canonical	Ubuntu 18.04 LTS	Unaffected: 37.1ubuntu0~18.04.1 (dpkg)
Canonical	Ubuntu 16.04 LTS	Unaffected: 37.1ubuntu0~16.04.1 (dpkg)

Date Public

2026-07-16 12:00

Credits

Mateusz Gierblinski

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-12391",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-16T13:20:30.714803Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-16T13:28:19.156Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/canonical/",
          "defaultStatus": "unaffected",
          "packageName": "ubuntu-pro-client",
          "platforms": [
            "Linux"
          ],
          "product": "ubuntu-pro-client (ubuntu-advantage-tools)",
          "repo": "https://github.com/canonical/ubuntu-pro-client",
          "vendor": "Canonical",
          "versions": [
            {
              "lessThan": "37.3",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/resolute",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 26.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.2ubuntu0.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/noble",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 24.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.2ubuntu~24.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/jammy",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 22.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.2ubuntu~22.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/focal",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 20.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.1ubuntu0~20.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/bionic",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 18.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.1ubuntu0~18.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/xenial",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 16.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.1ubuntu0~16.04.1",
              "versionType": "dpkg"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mateusz Gierblinski"
        }
      ],
      "datePublic": "2026-07-16T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An insecure symlink following vulnerability exists in Canonical\u003cbr\u003eubuntu-pro-client (formerly ubuntu-advantage-tools) within the\u003cbr\u003epro collect-logs command framework. The utility creates or utilizes\u003cbr\u003epredictable temporary file paths or user-accessible log directories when\u003cbr\u003egathering diagnostic information without verifying the file type or ownership.\u003cbr\u003eAn unprivileged local attacker can exploit this behavior by creating a\u003cbr\u003esymbolic link (symlink) at a predictable destination path pointing to an\u003cbr\u003earbitrary, root-readable file (such as /etc/shadow or private files within\u003cbr\u003e/root).\u003cbr\u003eWhen a root administrator or operator subsequently executes the\u003cbr\u003epro collect-logs command, the tool follows the user-controlled symlink, reads\u003cbr\u003ethe target file, and compresses its contents into the resulting diagnostic\u003cbr\u003esupport archive. Because the output archive remains readable by the\u003cbr\u003eunprivileged user, the attacker can extract and read the sensitive root-owned\u003cbr\u003efiles, leading to a complete information disclosure of system secrets.\u003cbr\u003e"
            }
          ],
          "value": "An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-132",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-132 Symlink Attack"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59 Improper link resolution before file access (\u0027link following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-16T12:17:01.094Z",
        "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
        "shortName": "canonical"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://ubuntu.com/security/CVE-2026-12391"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "ubuntu-pro-client Local Privilege Escalation and Information Disclosure via Symlink Arbitrary File Read in collect-logs"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
    "assignerShortName": "canonical",
    "cveId": "CVE-2026-12391",
    "datePublished": "2026-07-16T12:17:01.094Z",
    "dateReserved": "2026-06-16T12:15:12.153Z",
    "dateUpdated": "2026-07-16T13:28:19.156Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-11386 (GCVE-0-2026-11386)

Vulnerability from cvelistv5 – Published: 2026-07-16 12:16 – Updated: 2026-07-16 13:31

Title

ubuntu-pro-client Input Validation Vulnerability Leading to Arbitrary APT Directive Injection and Remote Code Execution

Summary

An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.

Severity

9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-16 13:30 UTC

CWE

CWE-20 - Improper input validation

Assigner

canonical mitre root

References

1 reference

URL	Tags
https://ubuntu.com/security/CVE-2026-11386	vdb-entry

Impacted products

8 products

Vendor	Product	Version
Canonical	ubuntu-pro-client (ubuntu-advantage-tools)	Affected: 0 , < 37.3 (python)
Canonical	Ubuntu 26.04 LTS	Unaffected: 37.2ubuntu0.1 (dpkg)
Canonical	Ubuntu 24.04 LTS	Unaffected: 37.2ubuntu~24.04.1 (dpkg)
Canonical	Ubuntu 22.04 LTS	Unaffected: 37.2ubuntu~22.04.1 (dpkg)
Canonical	Ubuntu 20.04 LTS	Unaffected: 37.1ubuntu0~20.04.1 (dpkg)
Canonical	Ubuntu 18.04 LTS	Unaffected: 37.1ubuntu0~18.04.1 (dpkg)
Canonical	Ubuntu 16.04 LTS	Unaffected: 37.1ubuntu0~16.04.1 (dpkg)
Canonical	Ubuntu 14.04 LTS	Unaffected: 19.7ubuntu0.1 (dpkg)

Date Public

2026-07-16 12:00

Credits

Frederick Jerusha

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-11386",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-16T13:30:45.443694Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-16T13:31:16.910Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/canonical/",
          "defaultStatus": "unaffected",
          "packageName": "ubuntu-pro-client",
          "platforms": [
            "Linux"
          ],
          "product": "ubuntu-pro-client (ubuntu-advantage-tools)",
          "repo": "https://github.com/canonical/ubuntu-pro-client",
          "vendor": "Canonical",
          "versions": [
            {
              "lessThan": "37.3",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/resolute",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 26.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.2ubuntu0.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/noble",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 24.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.2ubuntu~24.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/jammy",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 22.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.2ubuntu~22.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/focal",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 20.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.1ubuntu0~20.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/bionic",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 18.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.1ubuntu0~18.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/xenial",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 16.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.1ubuntu0~16.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/trusty",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 14.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "19.7ubuntu0.1",
              "versionType": "dpkg"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Frederick Jerusha"
        }
      ],
      "datePublic": "2026-07-16T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An input validation and injection vulnerability exists in Canonical\u003cbr\u003eubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs\u003cbr\u003eAPT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their\u003cbr\u003eDEB822 equivalents) using data received directly from the contract server\u003cbr\u003eresponse via the directives.suites[] and directives.aptURL fields. Because\u003cbr\u003ethe client utilizes Python\u0027s str.format() to write these files without\u003cbr\u003eperforming escaping, validation, or newline character filtering, a malicious\u003cbr\u003eor tampered contract response containing embedded newline (\\n) characters can\u003cbr\u003esuccessfully inject arbitrary, attacker-controlled deb configuration lines into\u003cbr\u003eroot-owned APT sources.\u003cbr\u003eWhen combined with the unvalidated additionalPackages[] field\u2014which is passed\u003cbr\u003epositionally into a root-executed apt-get install command\u2014an attacker capable of\u003cbr\u003espoofing or manipulating the contract response (e.g., via a compromised internal\u003cbr\u003einfrastructure, an intercepted connection utilizing a trusted CA, or local logical\u003cbr\u003ebugs) can force the client to fetch and install malicious packages. This ultimately\u003cbr\u003eleads to arbitrary code execution with root privileges on the affected system. This\u003cbr\u003ecomponent is preinstalled on supported Ubuntu Server releases and auto-attaches by\u003cbr\u003edefault on cloud provider Ubuntu Pro images."
            }
          ],
          "value": "An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python\u0027s str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field\u2014which is passed positionally into a root-executed apt-get install command\u2014an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-242",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-242 Code Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper input validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-16T12:16:02.508Z",
        "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
        "shortName": "canonical"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://ubuntu.com/security/CVE-2026-11386"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "ubuntu-pro-client Input Validation Vulnerability Leading to Arbitrary APT Directive Injection and Remote Code Execution"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
    "assignerShortName": "canonical",
    "cveId": "CVE-2026-11386",
    "datePublished": "2026-07-16T12:16:02.508Z",
    "dateReserved": "2026-06-05T15:11:57.169Z",
    "dateUpdated": "2026-07-16T13:31:16.910Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-9494 (GCVE-0-2026-9494)

Vulnerability from cvelistv5 – Published: 2026-07-16 12:12 – Updated: 2026-07-16 15:11

Title

ubuntu-pro-client Information Disclosure via Cleartext Bearer Token Exposure in Process Command Line

Summary

An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:<token>@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token directly from /proc/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-16 13:36 UTC

CWE

CWE-214 - Invocation of process using visible sensitive information

Assigner

canonical mitre root

References

1 reference

URL	Tags
https://ubuntu.com/security/CVE-2026-9494	vdb-entry

Impacted products

8 products

Vendor	Product	Version
Canonical	ubuntu-pro-client (ubuntu-advantage-tools)	Affected: 0 , < 37.3 (python)
Canonical	Ubuntu 26.04 LTS	Unaffected: 37.2ubuntu0.1 (dpkg)
Canonical	Ubuntu 24.04 LTS	Unaffected: 37.2ubuntu~24.04.1 (dpkg)
Canonical	Ubuntu 22.04 LTS	Unaffected: 37.2ubuntu~22.04.1 (dpkg)
Canonical	Ubuntu 20.04 LTS	Unaffected: 37.1ubuntu0~20.04.1 (dpkg)
Canonical	Ubuntu 18.04 LTS	Unaffected: 37.1ubuntu0~18.04.1 (dpkg)
Canonical	Ubuntu 16.04 LTS	Unaffected: 37.1ubuntu0~16.04.1 (dpkg)
Canonical	Ubuntu 14.04 LTS	Unaffected: 19.7ubuntu0.1 (dpkg)

Date Public

2026-07-16 12:00

Credits

Bilal Teke

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9494",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-16T13:36:06.361605Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-16T15:11:07.229Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/canonical/",
          "defaultStatus": "unaffected",
          "packageName": "ubuntu-pro-client",
          "platforms": [
            "Linux"
          ],
          "product": "ubuntu-pro-client (ubuntu-advantage-tools)",
          "repo": "https://github.com/canonical/ubuntu-pro-client",
          "vendor": "Canonical",
          "versions": [
            {
              "lessThan": "37.3",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/resolute",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 26.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.2ubuntu0.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/noble",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 24.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.2ubuntu~24.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/jammy",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 22.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.2ubuntu~22.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/focal",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 20.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.1ubuntu0~20.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/bionic",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 18.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.1ubuntu0~18.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/xenial",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 16.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "37.1ubuntu0~16.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/trusty",
          "defaultStatus": "affected",
          "packageName": "ubuntu-advantage-tools",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 14.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "19.7ubuntu0.1",
              "versionType": "dpkg"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Bilal Teke"
        }
      ],
      "datePublic": "2026-07-16T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An information disclosure vulnerability exists in Canonical ubuntu-pro-client\u003cbr\u003e(formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT\u003cbr\u003ecredentials by executing /usr/lib/apt/apt-helper using the download-file\u003cbr\u003ecommand. During this process, the secret bearer token is embedded directly in\u003cbr\u003ethe cleartext URL component passed via the command-line arguments (argv),\u003cbr\u003eresulting in a URL format such as https://bearer:\u003ctoken\u003e@esm.ubuntu.com/.../.\u003cbr\u003eOn systems utilizing a default-mounted /proc file system where process-hiding\u003cbr\u003emitigations (such as hidepid) are disabled, an unprivileged local attacker can\u003cbr\u003emonitor system processes and read the sensitive bearer token directly from\u003cbr\u003e/proc/cmdline while the helper process is actively running. This leaked\u003cbr\u003etoken can subsequently be used to gain unauthorized access to the victim\u0027s\u003cbr\u003eUbuntu Pro or Expanded Security Maintenance (ESM) repositories.\u003cbr\u003e"
            }
          ],
          "value": "An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in\nthe cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:\u003ctoken\u003e@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can\nmonitor system processes and read the sensitive bearer token directly from /proc/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim\u0027s Ubuntu Pro or Expanded Security Maintenance (ESM) repositories."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-13",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-13 Subverting Environment Variable Values"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-214",
              "description": "CWE-214 Invocation of process using visible sensitive information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-16T12:12:27.447Z",
        "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
        "shortName": "canonical"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://ubuntu.com/security/CVE-2026-9494"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "ubuntu-pro-client Information Disclosure via Cleartext Bearer Token Exposure in Process Command Line"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
    "assignerShortName": "canonical",
    "cveId": "CVE-2026-9494",
    "datePublished": "2026-07-16T12:12:27.447Z",
    "dateReserved": "2026-05-25T08:23:24.573Z",
    "dateUpdated": "2026-07-16T15:11:07.229Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-3888 (GCVE-0-2026-3888)

Vulnerability from cvelistv5 – Published: 2026-03-17 14:02 – Updated: 2026-03-18 08:59

Title

Local Privilege Escalation in snapd

Summary

Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-17 00:00 UTC

CWE

CWE-268 - Privilege chaining

Assigner

canonical mitre root

References

6 references

URL	Tags
https://ubuntu.com/security/CVE-2026-3888	vdb-entryissue-tracking
https://ubuntu.com/security/notices/USN-8102-1	vendor-advisory
https://discourse.ubuntu.com/t/snapd-local-privil…	technical-descriptionvendor-advisory
https://blog.qualys.com/vulnerabilities-threat-re…	technical-descriptionmedia-coverage
https://cdn2.qualys.com/advisory/2026/03/17/snap-…	technical-descriptionmedia-coverage
http://www.openwall.com/lists/oss-security/2026/03/18/1

Impacted products

6 products

Vendor	Product	Version
		Affected: 0 , < 2.75.1 (semver)
Canonical	Ubuntu 16.04 LTS	Unaffected: 2.61.4ubuntu0.16.04.1+esm2 , < * (dpkg)
Canonical	Ubuntu 18.04 LTS	Unaffected: 2.61.4ubuntu0.18.04.1+esm2 , < * (dpkg)
Canonical	Ubuntu 20.04 LTS	Unaffected: 2.67.1+20.04ubuntu1~esm1 , < * (dpkg)
Canonical	Ubuntu 22.04 LTS	Unaffected: 2.73+ubuntu22.04.1 , < * (dpkg)
Canonical	Ubuntu 24.04 LTS	Unaffected: 2.73+ubuntu24.04.2 , < * (dpkg)

Date Public

2026-03-17 14:00

Credits

Qualys Security Advisory Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-3888",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-17T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-18T03:55:45.787Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-03-18T03:02:10.640Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/03/18/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/canonical",
          "defaultStatus": "unaffected",
          "packageName": "snapd",
          "repo": "https://github.com/canonical/snapd/",
          "versions": [
            {
              "lessThan": "2.75.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/xenial",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 16.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.61.4ubuntu0.16.04.1+esm2",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/bionic",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 18.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.61.4ubuntu0.18.04.1+esm2",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/focal",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 20.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.67.1+20.04ubuntu1~esm1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/jammy",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 22.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.73+ubuntu22.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/noble",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 24.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.73+ubuntu24.04.2",
              "versionType": "dpkg"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Qualys Security Advisory Team"
        }
      ],
      "datePublic": "2026-03-17T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap\u0027s private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-268",
              "description": "CWE-268 Privilege chaining",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-18T08:59:07.522Z",
        "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
        "shortName": "canonical"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "issue-tracking"
          ],
          "url": "https://ubuntu.com/security/CVE-2026-3888"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://ubuntu.com/security/notices/USN-8102-1"
        },
        {
          "tags": [
            "technical-description",
            "vendor-advisory"
          ],
          "url": "https://discourse.ubuntu.com/t/snapd-local-privilege-escalation-cve-2026-3888"
        },
        {
          "tags": [
            "technical-description",
            "media-coverage"
          ],
          "url": "https://blog.qualys.com/vulnerabilities-threat-research/2026/03/17/cve-2026-3888-important-snap-flaw-enables-local-privilege-escalation-to-root"
        },
        {
          "tags": [
            "technical-description",
            "media-coverage"
          ],
          "url": "https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-systemd-tmpfiles.txt"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Local Privilege Escalation in snapd"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
    "assignerShortName": "canonical",
    "cveId": "CVE-2026-3888",
    "datePublished": "2026-03-17T14:02:08.475Z",
    "dateReserved": "2026-03-10T16:03:08.583Z",
    "dateUpdated": "2026-03-18T08:59:07.522Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

12 vulnerabilities found for Ubuntu 18.04 LTS by Canonical

CVE-2026-15226 (GCVE-0-2026-15226)

CVE-2024-5300 (GCVE-0-2024-5300)

CVE-2026-9494 (GCVE-0-2026-9494)

CVE-2026-12391 (GCVE-0-2026-12391)

CVE-2026-11386 (GCVE-0-2026-11386)

CVE-2026-3888 (GCVE-0-2026-3888)

CVE-2026-15226 (GCVE-0-2026-15226)

CVE-2024-5300 (GCVE-0-2024-5300)

CVE-2026-12391 (GCVE-0-2026-12391)

CVE-2026-11386 (GCVE-0-2026-11386)

CVE-2026-9494 (GCVE-0-2026-9494)

CVE-2026-3888 (GCVE-0-2026-3888)