CVE catalog
CVE-2026-8933
A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure execution environment for snap applicati
- Severity
- High · CVSS 7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.18% · Oct 25, 2026
A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure execution environment for snap applications. This vulnerability uniquely affects versions of snap-confine configured with set-capabilities (rather than standard set-uid-root installations). Due to a flaw in how privilege boundaries or security sandboxes are initialized when the binary runs under limited ambient capabilities, a local, unprivileged attacker can exploit this behavior to bypass intended restrictions and execute arbitrary code. Successful exploitation allows the local user to elevate their privileges to full root authority.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | snapd | sid | 2.77.1-2 | fixed |
| Debian | snapd | forky | 2.77.1-2 | fixed |
| Debian | snapd | trixie | 2.68.3-3+deb13u1 | vulnerable |
| Debian | snapd | trixie-security | 2.68.3-3+deb13u1 | vulnerable |
| Debian | snapd | bookworm | 2.57.6-1+deb12u1 | not affected |
| Debian | snapd | bookworm-security | 2.57.6-1+deb12u1 | not affected |
| Cpe | snapd | Not reported | 2.76+ubuntu24.04.1 | fixed |
| Cpe | golang-github-snapcore-snapd-dev | Not reported | 2.76+ubuntu24.04.1 | fixed |
| Cpe | golang-github-ubuntu-core-snappy-dev | Not reported | 2.76+ubuntu24.04.1 | fixed |
| Cpe | snap-confine | Not reported | 2.76+ubuntu24.04.1 | fixed |
| Cpe | snapd-xdg-open | Not reported | 2.76+ubuntu24.04.1 | fixed |
| Cpe | ubuntu-core-launcher | Not reported | 2.76+ubuntu24.04.1 | fixed |
| Cpe | ubuntu-core-snapd-units | Not reported | 2.76+ubuntu24.04.1 | fixed |
| Cpe | ubuntu-snappy | Not reported | 2.76+ubuntu24.04.1 | fixed |
| Cpe | ubuntu-snappy-cli | Not reported | 2.76+ubuntu24.04.1 | fixed |
| Ubuntu | snapd | 22.04 | 2.53+21.10ubuntu1 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.54.2+22.04ubuntu1 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.54.2+22.04ubuntu2 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.54.2+22.04ubuntu3 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.54.3+git19.g868fc21+22.04 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.54.3+git26.g360067e+22.04 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.55.2+22.04 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.55.2+22.04.1 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.55.3+22.04 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.55.3+22.04ubuntu1 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.55.5+22.04 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.56.2+22.04ubuntu1 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.57.4+22.04 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.57.5+22.04 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.57.5+22.04ubuntu0.1 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.58+22.04 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.58+22.04.1 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.61.3+22.04 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.62+22.04 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.63+22.04 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.63+22.04ubuntu0.1 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.65.3+22.04 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.66.1+22.04 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.67.1+22.04 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.68.5+ubuntu22.04.1 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.71+ubuntu22.04 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.72+ubuntu22.04 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.73+ubuntu22.04 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.73+ubuntu22.04.1 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.74.1+ubuntu22.04.4 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.75.2+ubuntu22.04 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.76+ubuntu22.04 | vulnerable |
| Ubuntu | snapd | 22.04 | 2.76+ubuntu22.04.1 | fixed |
| Ubuntu | snapd | 24.04 | 2.60.4+23.10 | vulnerable |
| Ubuntu | snapd | 24.04 | 2.61.3+24.04 | vulnerable |
| Ubuntu | snapd | 24.04 | 2.62+24.04build1 | vulnerable |
| Ubuntu | snapd | 24.04 | 2.63+24.04 | vulnerable |
| Ubuntu | snapd | 24.04 | 2.63+24.04ubuntu0.1 | vulnerable |
| Ubuntu | snapd | 24.04 | 2.63.1+24.04 | vulnerable |
| Ubuntu | snapd | 24.04 | 2.65.3+24.04 | vulnerable |
| Ubuntu | snapd | 24.04 | 2.66.1+24.04 | vulnerable |
| Ubuntu | snapd | 24.04 | 2.67.1+24.04 | vulnerable |
| Ubuntu | snapd | 24.04 | 2.68.5+ubuntu24.04.1 | vulnerable |
| Ubuntu | snapd | 24.04 | 2.71+ubuntu24.04 | vulnerable |
| Ubuntu | snapd | 24.04 | 2.72+ubuntu24.04 | vulnerable |
| Ubuntu | snapd | 24.04 | 2.73+ubuntu24.04 | vulnerable |
| Ubuntu | snapd | 24.04 | 2.73+ubuntu24.04.1 | vulnerable |
| Ubuntu | snapd | 24.04 | 2.73+ubuntu24.04.2 | vulnerable |
| Ubuntu | snapd | 24.04 | 2.74.1+ubuntu24.04.4 | vulnerable |
| Ubuntu | snapd | 24.04 | 2.75.2+ubuntu24.04 | vulnerable |
| Ubuntu | snapd | 24.04 | 2.76+ubuntu24.04 | vulnerable |
| Ubuntu | snapd | 24.04 | 2.76+ubuntu24.04.1 | fixed |
| Ubuntu | snapd | 26.04 | 2.71.1+ubuntu25.10.1 | vulnerable |
| Ubuntu | snapd | 26.04 | 2.72+ubuntu26.04.1 | vulnerable |
| Ubuntu | snapd | 26.04 | 2.73+ubuntu26.04.1 | vulnerable |
| Ubuntu | snapd | 26.04 | 2.74+ubuntu26.04 | vulnerable |
| Ubuntu | snapd | 26.04 | 2.74.1+ubuntu26.04 | vulnerable |
| Ubuntu | snapd | 26.04 | 2.74.1+ubuntu26.04.3 | vulnerable |
| Ubuntu | snapd | 26.04 | 2.74.1+ubuntu26.04.4 | vulnerable |
| Ubuntu | snapd | 26.04 | 2.75.2+ubuntu26.04.2 | vulnerable |
| Ubuntu | snapd | 26.04 | 2.76+ubuntu26.04.2 | vulnerable |
| Ubuntu | snapd | 26.04 | 2.76+ubuntu26.04.3 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | snapd | source | sid | 2.76.3-1 | not yet assigned | Not reported | [1142551] |
| Debian | snapd | source | forky | 2.76.3-1 | not yet assigned | Not reported | [1142551] |
| Debian | snapd | source | trixie | (unfixed) | not yet assigned | Not reported | [1142551] |
| Debian | snapd | source | bookworm | Not affected | unimportant | Not reported | [1142551] |
| Cpe | snapd | cpe | Not reported | 2.76+ubuntu24.04.1 | Not reported | Not reported | Not reported |
| Cpe | golang-github-snapcore-snapd-dev | cpe | Not reported | 2.76+ubuntu24.04.1 | Not reported | Not reported | Not reported |
| Cpe | golang-github-ubuntu-core-snappy-dev | cpe | Not reported | 2.76+ubuntu24.04.1 | Not reported | Not reported | Not reported |
| Cpe | snap-confine | cpe | Not reported | 2.76+ubuntu24.04.1 | Not reported | Not reported | Not reported |
| Cpe | snapd-xdg-open | cpe | Not reported | 2.76+ubuntu24.04.1 | Not reported | Not reported | Not reported |
| Cpe | ubuntu-core-launcher | cpe | Not reported | 2.76+ubuntu24.04.1 | Not reported | Not reported | Not reported |
| Cpe | ubuntu-core-snapd-units | cpe | Not reported | 2.76+ubuntu24.04.1 | Not reported | Not reported | Not reported |
| Cpe | ubuntu-snappy | cpe | Not reported | 2.76+ubuntu24.04.1 | Not reported | Not reported | Not reported |
| Cpe | ubuntu-snappy-cli | cpe | Not reported | 2.76+ubuntu24.04.1 | Not reported | Not reported | Not reported |
| Ubuntu | snapd | deb | 22.04 | 2.76+ubuntu22.04.1 | Not reported | UBUNTU-CVE-2026-8933 | Not reported |
| Ubuntu | snapd | deb | 24.04 | 2.76+ubuntu24.04.1 | Not reported | UBUNTU-CVE-2026-8933 | Not reported |
| Ubuntu | snapd | deb | 26.04 | 2.76+ubuntu26.04.3 | Not reported | UBUNTU-CVE-2026-8933 | Not reported |
Notes
[trixie] snapd: Not exploitable as snap-confine not yet installed with set capabilities
OpenFactory catalog packages
[Debian 13 (Trixie)]
- [golang-github-snapcore-snapd-dev]Affected
Source package: [snapd]
Details (4)
2.68.3-3+deb13u1· all · trixieAffected
nvd · snapd · debian · 13
2.68.3-3+deb13u1· all · trixieAffected
nvd · snapd · debian · 13
2.68.3-3+deb13u1· all · trixie-securityAffected
nvd · snapd · debian · 13
2.68.3-3+deb13u1· all · trixie-securityAffected
nvd · snapd · debian · 13
- [snap-confine]Affected
Source package: [snapd]
Details (4)
2.68.3-3+deb13u1+b6· amd64 · trixieAffected
nvd · snapd · debian · 13
2.68.3-3+deb13u1+b6· arm64 · trixieAffected
nvd · snapd · debian · 13
2.68.3-3+deb13u1· amd64 · trixie-securityAffected
nvd · snapd · debian · 13
2.68.3-3+deb13u1· arm64 · trixie-securityAffected
nvd · snapd · debian · 13
- [snapd]Affected
Details (4)
2.68.3-3+deb13u1+b6· amd64 · trixieAffected
nvd · snapd · debian · 13
2.68.3-3+deb13u1+b6· arm64 · trixieAffected
nvd · snapd · debian · 13
2.68.3-3+deb13u1· amd64 · trixie-securityAffected
nvd · snapd · debian · 13
2.68.3-3+deb13u1· arm64 · trixie-securityAffected
nvd · snapd · debian · 13
- [ubuntu-core-launcher]Affected
Source package: [snapd]
Details (4)
2.68.3-3+deb13u1+b6· amd64 · trixieAffected
nvd · snapd · debian · 13
2.68.3-3+deb13u1+b6· arm64 · trixieAffected
nvd · snapd · debian · 13
2.68.3-3+deb13u1· amd64 · trixie-securityAffected
nvd · snapd · debian · 13
2.68.3-3+deb13u1· arm64 · trixie-securityAffected
nvd · snapd · debian · 13
[Debian 12 (Bookworm)]
- [golang-github-snapcore-snapd-dev]Not affected
Source package: [snapd]
Details (4)
2.57.6-1+deb12u1· all · bookwormNot affected
nvd · snapd · debian · bookworm
2.57.6-1+deb12u1· all · bookwormNot affected
nvd · snapd · debian · bookworm
2.57.6-1+deb12u1· all · bookworm-securityNot affected
nvd · snapd · debian · bookworm
2.57.6-1+deb12u1· all · bookworm-securityNot affected
nvd · snapd · debian · bookworm
- [snap-confine]Not affected
Source package: [snapd]
Details (4)
2.57.6-1+deb12u1+b2· amd64 · bookwormNot affected
nvd · snapd · debian · bookworm
2.57.6-1+deb12u1+b2· arm64 · bookwormNot affected
nvd · snapd · debian · bookworm
2.57.6-1+deb12u1· amd64 · bookworm-securityNot affected
nvd · snapd · debian · bookworm
2.57.6-1+deb12u1· arm64 · bookworm-securityNot affected
nvd · snapd · debian · bookworm
- [snapd]Not affected
Details (4)
2.57.6-1+deb12u1+b2· amd64 · bookwormNot affected
nvd · snapd · debian · bookworm
2.57.6-1+deb12u1+b2· arm64 · bookwormNot affected
nvd · snapd · debian · bookworm
2.57.6-1+deb12u1· amd64 · bookworm-securityNot affected
nvd · snapd · debian · bookworm
2.57.6-1+deb12u1· arm64 · bookworm-securityNot affected
nvd · snapd · debian · bookworm
- [ubuntu-core-launcher]Not affected
Source package: [snapd]
Details (4)
2.57.6-1+deb12u1+b2· amd64 · bookwormNot affected
nvd · snapd · debian · bookworm
2.57.6-1+deb12u1+b2· arm64 · bookwormNot affected
nvd · snapd · debian · bookworm
2.57.6-1+deb12u1· amd64 · bookworm-securityNot affected
nvd · snapd · debian · bookworm
2.57.6-1+deb12u1· arm64 · bookworm-securityNot affected
nvd · snapd · debian · bookworm
Observed:
References
- [https://nvd.nist.gov/vuln/detail/CVE-2026-8933]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-8933]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-8933]
- [https://security-tracker.debian.org/tracker/CVE-2026-8933]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8933.json]
- [https://ubuntu.com/security/notices/USN-8579-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2469.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [Ubuntu Security Notices (USN)]