CVE catalog

CVE-2026-15226

A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler (snap-confine). The default seccomp security templates generated by the engine t

[CVE catalog]

Severity
High · CVSS 8.4CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.18% · Oct 25, 2026

A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler (snap-confine). The default seccomp security templates generated by the engine to restrict system calls do not filter or reject process operations capable of creating or manipulating file execution flags with set-user-ID attributes. Consequently, an application running within a strictly confined snap environment can successfully compile or drop binaries and apply setuid properties to them. If a compromised or malicious process inside the snap sandbox executes these generated setuid binaries, it can potentially circumvent architectural sandboxing assumptions, drop intended restriction policies, or execute privileged actions inside the container namespace that should otherwise be strictly blocked. The vulnerability has been resolved by hardening the seccomp template engine to block the execution and creation of setuid executables by sandboxed snap processes.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiansnapdsid2.77.1-2fixed
Debiansnapdforky2.77.1-2fixed
Debiansnapdtrixie2.68.3-3+deb13u1vulnerable
Debiansnapdtrixie-security2.68.3-3+deb13u1vulnerable
Debiansnapdbookworm2.57.6-1+deb12u1vulnerable
Debiansnapdbookworm-security2.57.6-1+deb12u1vulnerable
CpesnapdNot reportedNot reportedvulnerable
CpesnapdNot reported2.76+ubuntu24.04.1fixed
Cpegolang-github-snapcore-snapd-devNot reported2.76+ubuntu24.04.1fixed
Cpegolang-github-ubuntu-core-snappy-devNot reported2.76+ubuntu24.04.1fixed
Cpesnap-confineNot reported2.76+ubuntu24.04.1fixed
Cpesnapd-xdg-openNot reported2.76+ubuntu24.04.1fixed
Cpeubuntu-core-launcherNot reported2.76+ubuntu24.04.1fixed
Cpeubuntu-core-snapd-unitsNot reported2.76+ubuntu24.04.1fixed
Cpeubuntu-snappyNot reported2.76+ubuntu24.04.1fixed
Cpeubuntu-snappy-cliNot reported2.76+ubuntu24.04.1fixed
Ubuntusnapdpro2.41+19.10.1vulnerable
Ubuntusnapdpro2.42.1+20.04vulnerable
Ubuntusnapdpro2.43.3+git1.8109f8vulnerable
Ubuntusnapdpro2.44~pre1+20.04vulnerable
Ubuntusnapdpro2.44+20.04vulnerable
Ubuntusnapdpro2.44.2+20.04vulnerable
Ubuntusnapdpro2.44.3+20.04vulnerable
Ubuntusnapdpro2.45.1+20.04vulnerable
Ubuntusnapdpro2.45.1+20.04.2vulnerable
Ubuntusnapdpro2.46.1+20.04vulnerable
Ubuntusnapdpro2.47.1+20.04vulnerable
Ubuntusnapdpro2.48+20.04vulnerable
Ubuntusnapdpro2.48.3+20.04vulnerable
Ubuntusnapdpro2.49.2+20.04vulnerable
Ubuntusnapdpro2.51.1+20.04ubuntu2vulnerable
Ubuntusnapdpro2.54.2+20.04ubuntu2vulnerable
Ubuntusnapdpro2.54.3+20.04vulnerable
Ubuntusnapdpro2.54.3+20.04.1vulnerable
Ubuntusnapdpro2.54.3+20.04.1ubuntu0.1vulnerable
Ubuntusnapdpro2.54.3+20.04.1ubuntu0.2vulnerable
Ubuntusnapdpro2.54.3+20.04.1ubuntu0.3vulnerable
Ubuntusnapdpro2.55.5+20.04vulnerable
Ubuntusnapdpro2.57.5+20.04vulnerable
Ubuntusnapdpro2.57.5+20.04ubuntu0.1vulnerable
Ubuntusnapdpro2.58+20.04vulnerable
Ubuntusnapdpro2.58+20.04.1vulnerable
Ubuntusnapdpro2.61.3+20.04vulnerable
Ubuntusnapdpro2.62+20.04vulnerable
Ubuntusnapdpro2.63+20.04vulnerable
Ubuntusnapdpro2.63+20.04ubuntu0.1vulnerable
Ubuntusnapdpro2.65.3+20.04vulnerable
Ubuntusnapdpro2.66.1+20.04vulnerable
Ubuntusnapdpro2.67.1+20.04vulnerable
Ubuntusnapdpro2.67.1+20.04ubuntu1~esm1vulnerable
Ubuntusnapdpro2.67.1+20.04ubuntu1~esm3fixed
Ubuntusnapd22.042.53+21.10ubuntu1vulnerable
Ubuntusnapd22.042.54.2+22.04ubuntu1vulnerable
Ubuntusnapd22.042.54.2+22.04ubuntu2vulnerable
Ubuntusnapd22.042.54.2+22.04ubuntu3vulnerable
Ubuntusnapd22.042.54.3+git19.g868fc21+22.04vulnerable
Ubuntusnapd22.042.54.3+git26.g360067e+22.04vulnerable
Ubuntusnapd22.042.55.2+22.04vulnerable
Ubuntusnapd22.042.55.2+22.04.1vulnerable
Ubuntusnapd22.042.55.3+22.04vulnerable
Ubuntusnapd22.042.55.3+22.04ubuntu1vulnerable
Ubuntusnapd22.042.55.5+22.04vulnerable
Ubuntusnapd22.042.56.2+22.04ubuntu1vulnerable
Ubuntusnapd22.042.57.4+22.04vulnerable
Ubuntusnapd22.042.57.5+22.04vulnerable
Ubuntusnapd22.042.57.5+22.04ubuntu0.1vulnerable
Ubuntusnapd22.042.58+22.04vulnerable
Ubuntusnapd22.042.58+22.04.1vulnerable
Ubuntusnapd22.042.61.3+22.04vulnerable
Ubuntusnapd22.042.62+22.04vulnerable
Ubuntusnapd22.042.63+22.04vulnerable
Ubuntusnapd22.042.63+22.04ubuntu0.1vulnerable
Ubuntusnapd22.042.65.3+22.04vulnerable
Ubuntusnapd22.042.66.1+22.04vulnerable
Ubuntusnapd22.042.67.1+22.04vulnerable
Ubuntusnapd22.042.68.5+ubuntu22.04.1vulnerable
Ubuntusnapd22.042.71+ubuntu22.04vulnerable
Ubuntusnapd22.042.72+ubuntu22.04vulnerable
Ubuntusnapd22.042.73+ubuntu22.04vulnerable
Ubuntusnapd22.042.73+ubuntu22.04.1vulnerable
Ubuntusnapd22.042.74.1+ubuntu22.04.4vulnerable
Ubuntusnapd22.042.75.2+ubuntu22.04vulnerable
Ubuntusnapd22.042.76+ubuntu22.04vulnerable
Ubuntusnapd22.042.76+ubuntu22.04.1fixed
Ubuntusnapd24.042.60.4+23.10vulnerable
Ubuntusnapd24.042.61.3+24.04vulnerable
Ubuntusnapd24.042.62+24.04build1vulnerable
Ubuntusnapd24.042.63+24.04vulnerable
Ubuntusnapd24.042.63+24.04ubuntu0.1vulnerable
Ubuntusnapd24.042.63.1+24.04vulnerable
Ubuntusnapd24.042.65.3+24.04vulnerable
Ubuntusnapd24.042.66.1+24.04vulnerable
Ubuntusnapd24.042.67.1+24.04vulnerable
Ubuntusnapd24.042.68.5+ubuntu24.04.1vulnerable
Ubuntusnapd24.042.71+ubuntu24.04vulnerable
Ubuntusnapd24.042.72+ubuntu24.04vulnerable
Ubuntusnapd24.042.73+ubuntu24.04vulnerable
Ubuntusnapd24.042.73+ubuntu24.04.1vulnerable
Ubuntusnapd24.042.73+ubuntu24.04.2vulnerable
Ubuntusnapd24.042.74.1+ubuntu24.04.4vulnerable
Ubuntusnapd24.042.75.2+ubuntu24.04vulnerable
Ubuntusnapd24.042.76+ubuntu24.04vulnerable
Ubuntusnapd24.042.76+ubuntu24.04.1fixed
Ubuntusnapd26.042.71.1+ubuntu25.10.1vulnerable
Ubuntusnapd26.042.72+ubuntu26.04.1vulnerable
Ubuntusnapd26.042.73+ubuntu26.04.1vulnerable
Ubuntusnapd26.042.74+ubuntu26.04vulnerable
Ubuntusnapd26.042.74.1+ubuntu26.04vulnerable
Ubuntusnapd26.042.74.1+ubuntu26.04.3vulnerable
Ubuntusnapd26.042.74.1+ubuntu26.04.4vulnerable
Ubuntusnapd26.042.75.2+ubuntu26.04.2vulnerable
Ubuntusnapd26.042.76+ubuntu26.04.2vulnerable
Ubuntusnapd26.042.76+ubuntu26.04.3fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiansnapdsourcesid2.76.3-1not yet assignedNot reported[1142551]
Debiansnapdsourceforky2.76.3-1not yet assignedNot reported[1142551]
Debiansnapdsourcetrixie(unfixed)not yet assignedNot reported[1142551]
Debiansnapdsourcebookworm(unfixed)not yet assignedNot reported[1142551]
CpesnapdcpeNot reported2.76+ubuntu24.04.1Not reportedNot reportedNot reported
Cpegolang-github-snapcore-snapd-devcpeNot reported2.76+ubuntu24.04.1Not reportedNot reportedNot reported
Cpegolang-github-ubuntu-core-snappy-devcpeNot reported2.76+ubuntu24.04.1Not reportedNot reportedNot reported
Cpesnap-confinecpeNot reported2.76+ubuntu24.04.1Not reportedNot reportedNot reported
Cpesnapd-xdg-opencpeNot reported2.76+ubuntu24.04.1Not reportedNot reportedNot reported
Cpeubuntu-core-launchercpeNot reported2.76+ubuntu24.04.1Not reportedNot reportedNot reported
Cpeubuntu-core-snapd-unitscpeNot reported2.76+ubuntu24.04.1Not reportedNot reportedNot reported
Cpeubuntu-snappycpeNot reported2.76+ubuntu24.04.1Not reportedNot reportedNot reported
Cpeubuntu-snappy-clicpeNot reported2.76+ubuntu24.04.1Not reportedNot reportedNot reported
Ubuntusnapddebpro2.67.1+20.04ubuntu1~esm3Not reportedUBUNTU-CVE-2026-15226Not reported
Ubuntusnapddeb22.042.76+ubuntu22.04.1Not reportedUBUNTU-CVE-2026-15226Not reported
Ubuntusnapddeb24.042.76+ubuntu24.04.1Not reportedUBUNTU-CVE-2026-15226Not reported
Ubuntusnapddeb26.042.76+ubuntu26.04.3Not reportedUBUNTU-CVE-2026-15226Not reported

[Debian bug #1142551]

Notes

[trixie] snapd: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-github-snapcore-snapd-dev]Affected

    Source package: [snapd]

    Details (4)

    • 2.57.6-1+deb12u1 · all · bookworm

      Affected

      nvd · snapd · debian · bookworm; nvd · snapd · debian · 12

    • 2.57.6-1+deb12u1 · all · bookworm

      Affected

      nvd · snapd · debian · bookworm; nvd · snapd · debian · 12

    • 2.57.6-1+deb12u1 · all · bookworm-security

      Affected

      nvd · snapd · debian · bookworm; nvd · snapd · debian · 12

    • 2.57.6-1+deb12u1 · all · bookworm-security

      Affected

      nvd · snapd · debian · bookworm; nvd · snapd · debian · 12

  • [snap-confine]Affected

    Source package: [snapd]

    Details (4)

    • 2.57.6-1+deb12u1+b2 · amd64 · bookworm

      Affected

      nvd · snapd · debian · bookworm; nvd · snapd · debian · 12

    • 2.57.6-1+deb12u1+b2 · arm64 · bookworm

      Affected

      nvd · snapd · debian · bookworm; nvd · snapd · debian · 12

    • 2.57.6-1+deb12u1 · amd64 · bookworm-security

      Affected

      nvd · snapd · debian · bookworm; nvd · snapd · debian · 12

    • 2.57.6-1+deb12u1 · arm64 · bookworm-security

      Affected

      nvd · snapd · debian · bookworm; nvd · snapd · debian · 12

  • [snapd]Affected
    Details (4)

    • 2.57.6-1+deb12u1+b2 · amd64 · bookworm

      Affected

      nvd · snapd · debian · bookworm; nvd · snapd · debian · 12

    • 2.57.6-1+deb12u1+b2 · arm64 · bookworm

      Affected

      nvd · snapd · debian · bookworm; nvd · snapd · debian · 12

    • 2.57.6-1+deb12u1 · amd64 · bookworm-security

      Affected

      nvd · snapd · debian · bookworm; nvd · snapd · debian · 12

    • 2.57.6-1+deb12u1 · arm64 · bookworm-security

      Affected

      nvd · snapd · debian · bookworm; nvd · snapd · debian · 12

  • [ubuntu-core-launcher]Affected

    Source package: [snapd]

    Details (4)

    • 2.57.6-1+deb12u1+b2 · amd64 · bookworm

      Affected

      nvd · snapd · debian · bookworm; nvd · snapd · debian · 12

    • 2.57.6-1+deb12u1+b2 · arm64 · bookworm

      Affected

      nvd · snapd · debian · bookworm; nvd · snapd · debian · 12

    • 2.57.6-1+deb12u1 · amd64 · bookworm-security

      Affected

      nvd · snapd · debian · bookworm; nvd · snapd · debian · 12

    • 2.57.6-1+deb12u1 · arm64 · bookworm-security

      Affected

      nvd · snapd · debian · bookworm; nvd · snapd · debian · 12

[Debian 13 (Trixie)]

  • [golang-github-snapcore-snapd-dev]Affected

    Source package: [snapd]

    Details (4)

    • 2.68.3-3+deb13u1 · all · trixie

      Affected

      nvd · snapd · debian · 13

    • 2.68.3-3+deb13u1 · all · trixie

      Affected

      nvd · snapd · debian · 13

    • 2.68.3-3+deb13u1 · all · trixie-security

      Affected

      nvd · snapd · debian · 13

    • 2.68.3-3+deb13u1 · all · trixie-security

      Affected

      nvd · snapd · debian · 13

  • [snap-confine]Affected

    Source package: [snapd]

    Details (4)

    • 2.68.3-3+deb13u1+b6 · amd64 · trixie

      Affected

      nvd · snapd · debian · 13

    • 2.68.3-3+deb13u1+b6 · arm64 · trixie

      Affected

      nvd · snapd · debian · 13

    • 2.68.3-3+deb13u1 · amd64 · trixie-security

      Affected

      nvd · snapd · debian · 13

    • 2.68.3-3+deb13u1 · arm64 · trixie-security

      Affected

      nvd · snapd · debian · 13

  • [snapd]Affected
    Details (4)

    • 2.68.3-3+deb13u1+b6 · amd64 · trixie

      Affected

      nvd · snapd · debian · 13

    • 2.68.3-3+deb13u1+b6 · arm64 · trixie

      Affected

      nvd · snapd · debian · 13

    • 2.68.3-3+deb13u1 · amd64 · trixie-security

      Affected

      nvd · snapd · debian · 13

    • 2.68.3-3+deb13u1 · arm64 · trixie-security

      Affected

      nvd · snapd · debian · 13

  • [ubuntu-core-launcher]Affected

    Source package: [snapd]

    Details (4)

    • 2.68.3-3+deb13u1+b6 · amd64 · trixie

      Affected

      nvd · snapd · debian · 13

    • 2.68.3-3+deb13u1+b6 · arm64 · trixie

      Affected

      nvd · snapd · debian · 13

    • 2.68.3-3+deb13u1 · amd64 · trixie-security

      Affected

      nvd · snapd · debian · 13

    • 2.68.3-3+deb13u1 · arm64 · trixie-security

      Affected

      nvd · snapd · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [Ubuntu Security Notices (USN)]