Three New Snap Vulnerabilities: One Dating Back to Ubuntu 16.04 LTS

Canonical has reported three new security vulnerabilities in snapd — the mechanism that manages Snap packages in Ubuntu. Two of them are rated high severity, while the third, classified as medium, spans every LTS release of Ubuntu over the past ten years, going all the way back to version 16.04.

What was found

The first vulnerability, CVE-2026-8933, was discovered by researchers at Qualys. It allows a local attacker to escalate their privileges on the system. The issue affects LTS releases of Ubuntu up through 22.04 and is rated high severity on the CVSS 3.1 scale.

The second high-severity vulnerability is CVE-2026-15226. It gives a local attacker the ability to break out of Snap's isolation: to move from a confined environment with root privileges into an unconfined root environment — in effect, to escape the sandbox.

The third issue, CVE-2024-5300, is rated medium severity, yet it is precisely its reach that makes it notable. The vulnerability affects LTS releases of Ubuntu all the way back to 16.04 and allows applications running in the sandbox to gain access to users' password hashes.

A long trail

It is this last vulnerability that draws particular attention: despite its medium severity, it lurked in the system for nearly a decade and affected a great many versions of the distribution. Snap's isolation mechanism, meant to restrict applications' access to the system, in practice left a loophole open to sensitive data.

Canonical has published the details on all three issues on its Ubuntu Discourse resource. As is customary in such cases, users are advised to install the security updates as soon as they become available for their Ubuntu release.

Source: Phoronix