Vulnerability · Published Jul 21, 2026 · Assigned by canonical
CVE-2026-8933snap-confine Local Privilege Escalation via Capabilities Misconfiguration or Flaw in Execution Environment Setup
High 7.8
In plain English
A high-severity security flaw in snapd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure execution environment for snap applications. This vulnerability uniquely affects versions of snap-confine configured with set-capabilities (rather than standard set-uid-root installations). Due to a flaw in how privilege boundaries or security sandboxes are initialized when the binary runs under limited ambient capabilities, a local, unprivileged attacker can exploit this behavior to bypass intended restrictions and execute arbitrary code. Successful exploitation allows the local user to elevate their privileges to full root authority.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | snapd | no fix listed | DEBIAN-CVE-2026-8933 |
| Debian:14 | snapd | 2.76.3-1 | DEBIAN-CVE-2026-8933 |
| Ubuntu:22.04:LTS | snapd | 2.76+ubuntu22.04.1 | UBUNTU-CVE-2026-8933 |
| Ubuntu:22.04:LTS | snapd | 2.76+ubuntu22.04.1 | USN-8579-1 |
| Ubuntu:24.04:LTS | snapd | 2.76+ubuntu24.04.1 | USN-8579-1 |
| Ubuntu:24.04:LTS | snapd | 2.76+ubuntu24.04.1 | UBUNTU-CVE-2026-8933 |
| Ubuntu:26.04:LTS | snapd | 2.76+ubuntu26.04.3 | USN-8579-1 |
| Ubuntu:26.04:LTS | snapd | 2.76+ubuntu26.04.3 | UBUNTU-CVE-2026-8933 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| snapd | 2.75.0 – before 2.76.1 | |
| Canonical | Ubuntu 26.04 LTS | see references |
| Canonical | Ubuntu 24.04 LTS | see references |
| Canonical | Ubuntu 22.04 LTS | see references |
Weakness: CWE-250 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://ubuntu.com/security/CVE-2026-8933 vdb-entry, issue-tracking