Loading story…
UpSnap disclosed and patched two high-severity vulnerabilities in version 5.4.0 affecting the wake-on-LAN web application. One flaw, tracked as CVE-2026-49819, affected fresh installations from versions 4.4.1 through 5.3.5 and allowed an unauthenticated network-adjacent attacker to complete the initial setup flow first, claim the first superuser account, and obtain a long-lived JWT. The issue could then be chained into root-level remote code execution through the application's wake functionality, yielding a CVSS 9.8 rating.
A second flaw, CVE-2026-49481, was an authenticated OS command injection bug in device management that let a low-privileged user inject shell metacharacters into IP or MAC fields used by wake_cmd and shutdown_cmd, leading to command execution via /bin/sh -c on Linux or cmd /C on Windows. UpSnap said the initial setup issue does not affect instances that were already fully initialized, while the command injection risk primarily impacts deployments where untrusted users can create or edit devices. The project mitigated the bugs by moving first superuser creation to a one-time PocketBase link shown only in server console logs, validating IP and MAC values in the backend, adding PocketBase regex constraints, and enforcing browser-side input patterns.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
A CVE entry was published for a critical UpSnap vulnerability chain affecting versions 4.4.1 through 5.3.5, in which an unauthenticated attacker on a fresh install could register the initial superuser account and potentially chain this to root remote code execution. The entry links the issue to GitHub advisory GHSA-w4jr-728f-5jhq and recommends upgrading to version 5.4.0 or later and removing unauthorized superuser accounts.
The CVE record for UpSnap's device IP and MAC command injection vulnerability was received by security-advisories@github.com. The issue affects versions prior to 5.4.0 and allows a low-privileged user who can create or edit devices to achieve authenticated remote code execution.
UpSnap released version 5.4.0 with fixes for two security issues: an initial setup flaw that could let an attacker claim the first superuser account on an uninitialized instance, and a command injection issue in device IP and MAC fields that could lead to server-side code execution. The release changed first-superuser creation to a one-time PocketBase setup link shown in server console logs and added backend, database, and browser-side validation for IP and MAC values.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Canonical disclosed and patched three **snapd** vulnerabilities, led by **CVE-2026-8933**, a high-severity local privilege escalation flaw in **snap-confine** that can let a local user gain **root** on affected Ubuntu Desktop systems. Qualys reported that Ubuntu Desktop 26.04, 25.10, and fully updated 24.04 installations using the file-capabilities configuration for `snap-confine` are exposed because the process retains near-root capabilities while operating with the attacker’s effective UID, allowing attacker-owned files and directories to be created during a race window. The flaw can be exploited through symlink-based arbitrary file creation and permission changes, then by planting a malicious udev rule in an AppArmor-permitted path under `/run/udev/`, which can be triggered to execute attacker-controlled commands as root via `systemd-udevd`. Canonical also addressed **CVE-2026-15226**, a **snap-confine** sandbox confinement bypass caused by missing `setuid` restrictions in seccomp templates, which could let code running inside a strictly confined snap create or manipulate setuid binaries and weaken confinement boundaries. A third issue, **CVE-2024-5300**, involved an AppArmor base profile misconfiguration that could expose hashed passwords through `systemd-userdbd`. Fixes are scheduled in **snapd 2.76.1** and corresponding Ubuntu package updates for Xenial, Bionic, Focal, Jammy, Noble, and Resolute, with Canonical publishing advisory **USN-8579-1**; Qualys said it had a working exploit for CVE-2026-8933 but reported no evidence of active exploitation.
Aug 11, 2026
**Qualys** disclosed **CVE-2026-3888**, a high-severity local privilege escalation flaw affecting default installations of **Ubuntu Desktop 24.04 and later**. The bug arises from the interaction between `snap-confine`, the setuid-root component used to build snap sandboxes, and `systemd-tmpfiles`, which periodically cleans stale data from temporary directories. An unprivileged local attacker can abuse the cleanup of `/tmp/.snap`, recreate the directory with malicious content, and eventually obtain **full root access**. The issue is rated **CVSS 7.8** and requires low privileges and no user interaction, but exploitation is constrained by a time-based window tied to the system's cleanup schedule. The vulnerable behavior is present in default Ubuntu Desktop deployments because both components are standard parts of the platform's snap confinement model. Reports note the cleanup interval is typically **30 days on Ubuntu 24.04** and **10 days on later versions**, which contributes to the exploit's higher attack complexity. **Patched versions** include `snapd` **2.73+ubuntu24.04.1** for Ubuntu 24.04 LTS, **2.73+ubuntu25.10.1** for Ubuntu 25.10 LTS, **2.74.1+ubuntu26.04.1** for Ubuntu 26.04 development builds, and **upstream snapd 2.75**. A separate report about **CVE-2026-32746** in GNU InetUtils `telnetd` describes a different, unrelated unauthenticated remote code execution issue and does not pertain to the Ubuntu `snap-confine` flaw.
Jun 29, 2026
SUSE disclosed four vulnerabilities in qSnapper’s privileged root D-Bus service, affecting versions through **1.3.2** and tracked as `CVE-2026-41045` through `CVE-2026-41048`. The flaws include a **Polkit race-condition authentication bypass**, a **path traversal** issue in the `configName` parameter, **information disclosure** through snapshot diff methods, and unsafe **authentication caching** that could allow one user’s authorization to be reused by another. SUSE said some bug chains could lead to **full local root exploitation**, while other impacts include denial of service, arbitrary file operations, and exposure of sensitive content such as diffs involving `/etc/shadow`. Upstream released **qSnapper 1.3.3** with fixes that change Polkit subject handling, validate `configName`, remove authentication caching, restrict diff access behind a new **`view-diff`** Polkit action, remove the unauthenticated `Quit` method, and harden log file permissions. SUSE also acknowledged additional defense-in-depth weaknesses in file restore logic that could support symlink-based privilege escalation or arbitrary file operations, but said those issues were not assigned separate CVEs and will be addressed later through open development.
Jun 29, 2026