CVE-2026-15226
Received Received - Intake

snapd Seccomp Bypass via setuid Binary Execution

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Canonical Ltd.

Description
A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler (snap-confine). The default seccomp security templates generated by the engine to restrict system calls do not filter or reject process operations capable of creating or manipulating file execution flags with set-user-ID attributes. Consequently, an application running within a strictly confined snap environment can successfully compile or drop binaries and apply setuid properties to them. If a compromised or malicious process inside the snap sandbox executes these generated setuid binaries, it can potentially circumvent architectural sandboxing assumptions, drop intended restriction policies, or execute privileged actions inside the container namespace that should otherwise be strictly blocked. The vulnerability has been resolved by hardening the seccomp template engine to block the execution and creation of setuid executables by sandboxed snap processes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-15226
EUVD
EUVD-2026-46261

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
canonical snapd *
canonical snapd to 21_july_2026 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-250 The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a sandbox confinement bypass in Canonical snapd's internal execution environment compiler (snap-confine). The issue occurs because the default seccomp security templates do not filter process operations that can create or manipulate file execution flags with set-user-ID attributes. This allows a confined snap application to compile or drop binaries and mark them as setuid, potentially enabling privilege escalation if executed.

Detection Guidance

Detecting this vulnerability requires checking snapd versions and seccomp profiles. Run 'snap list' to verify snapd version and 'snap --version' for details. Inspect seccomp templates with 'sudo cat /var/lib/snapd/seccomp/profiles/snap-confine' and check for setuid-related rules. Monitor logs for unauthorized setuid binary creation attempts in snap environments.

Impact Analysis

If you use snap packages on a system with vulnerable snapd, a malicious or compromised snap application could bypass sandbox restrictions. This might allow the application to execute privileged actions outside the intended container namespace, potentially leading to unauthorized system access or privilege escalation.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing privilege escalation within sandboxed environments. If exploited, it may enable unauthorized access to sensitive data or system resources, violating data protection requirements under these regulations.

Mitigation Strategies

Update snapd immediately using 'sudo apt update && sudo apt upgrade snapd'. Verify the fix with 'snap --version' to confirm version 2.58.3 or later. Review and restrict snap permissions via 'sudo snap set system experimental.snapd-sandboxing=true'. Audit installed snaps for untrusted sources and remove unnecessary ones.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15226. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart