Loading story…
SUSE disclosed four vulnerabilities in qSnapper’s privileged root D-Bus service, affecting versions through 1.3.2 and tracked as CVE-2026-41045 through CVE-2026-41048. The flaws include a Polkit race-condition authentication bypass, a path traversal issue in the configName parameter, information disclosure through snapshot diff methods, and unsafe authentication caching that could allow one user’s authorization to be reused by another. SUSE said some bug chains could lead to full local root exploitation, while other impacts include denial of service, arbitrary file operations, and exposure of sensitive content such as diffs involving /etc/shadow.
Upstream released qSnapper 1.3.3 with fixes that change Polkit subject handling, validate configName, remove authentication caching, restrict diff access behind a new view-diff Polkit action, remove the unauthenticated Quit method, and harden log file permissions. SUSE also acknowledged additional defense-in-depth weaknesses in file restore logic that could support symlink-based privilege escalation or arbitrary file operations, but said those issues were not assigned separate CVEs and will be addressed later through open development.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
SUSE disclosed multiple local security flaws in qSnapper's privileged D-Bus service affecting versions up to 1.3.2, including authentication bypass, path traversal, information disclosure, and potential local root exploitation. Upstream coordinated disclosure, accepted CVE assignments CVE-2026-41045 through CVE-2026-41048, and released fixes in qSnapper 1.3.3 on 2026-05-26.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcesecurity.opensuse.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Canonical disclosed and patched three **snapd** vulnerabilities, led by **CVE-2026-8933**, a high-severity local privilege escalation flaw in **snap-confine** that can let a local user gain **root** on affected Ubuntu Desktop systems. Qualys reported that Ubuntu Desktop 26.04, 25.10, and fully updated 24.04 installations using the file-capabilities configuration for `snap-confine` are exposed because the process retains near-root capabilities while operating with the attacker’s effective UID, allowing attacker-owned files and directories to be created during a race window. The flaw can be exploited through symlink-based arbitrary file creation and permission changes, then by planting a malicious udev rule in an AppArmor-permitted path under `/run/udev/`, which can be triggered to execute attacker-controlled commands as root via `systemd-udevd`. Canonical also addressed **CVE-2026-15226**, a **snap-confine** sandbox confinement bypass caused by missing `setuid` restrictions in seccomp templates, which could let code running inside a strictly confined snap create or manipulate setuid binaries and weaken confinement boundaries. A third issue, **CVE-2024-5300**, involved an AppArmor base profile misconfiguration that could expose hashed passwords through `systemd-userdbd`. Fixes are scheduled in **snapd 2.76.1** and corresponding Ubuntu package updates for Xenial, Bionic, Focal, Jammy, Noble, and Resolute, with Canonical publishing advisory **USN-8579-1**; Qualys said it had a working exploit for CVE-2026-8933 but reported no evidence of active exploitation.
Aug 11, 2026
**Qualys** disclosed **CVE-2026-3888**, a high-severity local privilege escalation flaw affecting default installations of **Ubuntu Desktop 24.04 and later**. The bug arises from the interaction between `snap-confine`, the setuid-root component used to build snap sandboxes, and `systemd-tmpfiles`, which periodically cleans stale data from temporary directories. An unprivileged local attacker can abuse the cleanup of `/tmp/.snap`, recreate the directory with malicious content, and eventually obtain **full root access**. The issue is rated **CVSS 7.8** and requires low privileges and no user interaction, but exploitation is constrained by a time-based window tied to the system's cleanup schedule. The vulnerable behavior is present in default Ubuntu Desktop deployments because both components are standard parts of the platform's snap confinement model. Reports note the cleanup interval is typically **30 days on Ubuntu 24.04** and **10 days on later versions**, which contributes to the exploit's higher attack complexity. **Patched versions** include `snapd` **2.73+ubuntu24.04.1** for Ubuntu 24.04 LTS, **2.73+ubuntu25.10.1** for Ubuntu 25.10 LTS, **2.74.1+ubuntu26.04.1** for Ubuntu 26.04 development builds, and **upstream snapd 2.75**. A separate report about **CVE-2026-32746** in GNU InetUtils `telnetd` describes a different, unrelated unauthenticated remote code execution issue and does not pertain to the Ubuntu `snap-confine` flaw.
Jun 29, 2026
UpSnap disclosed and patched two high-severity vulnerabilities in version **5.4.0** affecting the wake-on-LAN web application. One flaw, tracked as **`CVE-2026-49819`**, affected fresh installations from versions **4.4.1 through 5.3.5** and allowed an unauthenticated network-adjacent attacker to complete the initial setup flow first, claim the first superuser account, and obtain a long-lived JWT. The issue could then be chained into root-level remote code execution through the application's wake functionality, yielding a **CVSS 9.8** rating. A second flaw, **`CVE-2026-49481`**, was an authenticated OS command injection bug in device management that let a low-privileged user inject shell metacharacters into **IP** or **MAC** fields used by `wake_cmd` and `shutdown_cmd`, leading to command execution via `/bin/sh -c` on Linux or `cmd /C` on Windows. UpSnap said the initial setup issue does not affect instances that were already fully initialized, while the command injection risk primarily impacts deployments where untrusted users can create or edit devices. The project mitigated the bugs by moving first superuser creation to a one-time PocketBase link shown only in server console logs, validating IP and MAC values in the backend, adding PocketBase regex constraints, and enforcing browser-side input patterns.
Aug 13, 2026