# CVE-2024-5300: Canonical snapd access control bypass in AppArmor configuration

Source: https://junglewise.ai/threats/cve-2024-5300-canonical-snapd-access-control-bypass-in-apparmor-configuration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2024-5300 · Severity: medium · CVSS 5.6 · Published 2026-07-21

A security flaw in the AppArmor configuration for Canonical snapd allows restricted applications to bypass sandbox protections. If a malicious application is installed as a 'snap' and gains administrative privileges within its own container, it can steal sensitive system password hashes from the host computer. This could allow an attacker to perform offline password cracking to gain full control over other user accounts on the system.

Technologies: [Canonical Snapd](https://junglewise.ai/threats/technologies/snapd), [Canonical Ubuntu](https://junglewise.ai/threats/technologies/ubuntu). Vendors: [Canonical](https://junglewise.ai/threats/vendors/canonical).

## Quick answers

**Is CVE-2024-5300 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-5300 being exploited in the wild.

**How severe is CVE-2024-5300?** Medium severity, with a CVSS score of 5.6, published 21 July 2026.

**Which products and versions are affected?** Canonical Snapd before 2.76.1; Canonical Ubuntu before 2.76+ubuntu26.04.3.

**Is there a fix for CVE-2024-5300?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2024-5300 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2024-5300?** Check whether you run Canonical Snapd or Canonical Ubuntu at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An access control bypass exists in the AppArmor abstraction rules for nss-systemd within Canonical snapd. The vulnerability stems from rules in /etc/apparmor.d/abstractions/nss-systemd that inadvertently allow strictly confined snaps to communicate with io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets. When the systemd-userdbd service is active, it fails to differentiate between host-level root users and restricted root users within a snap sandbox. A malicious snap running as root can query the Varlink interface to retrieve complete user records, including sensitive hashed passwords from /etc/shadow. This issue is mitigated by the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments. Patches are available in snapd version 2.76.1 and corresponding Ubuntu package updates.

## Affected products

- Canonical snapd before 2.76.1
- Canonical Ubuntu 26.04 LTS before 2.76+ubuntu26.04.3
- Canonical Ubuntu 24.04 LTS before 2.76+ubuntu24.04.1
- Canonical Ubuntu 22.04 LTS before 2.76+ubuntu22.04.1
- Canonical Ubuntu 20.04 LTS before 2.67.1+20.04ubuntu1~esm2

## Timeline

- 2026-07-21: advisory
- 2026-07-21: disclosed

## References

- [https://github.com/canonical](https://github.com/canonical)
- [https://launchpad.net/ubuntu/resolute](https://launchpad.net/ubuntu/resolute)
- [https://launchpad.net/ubuntu/noble](https://launchpad.net/ubuntu/noble)
- [https://launchpad.net/ubuntu/jammy](https://launchpad.net/ubuntu/jammy)
- [https://launchpad.net/ubuntu/focal](https://launchpad.net/ubuntu/focal)
- [https://launchpad.net/ubuntu/bionic](https://launchpad.net/ubuntu/bionic)
- [https://launchpad.net/ubuntu/xenial](https://launchpad.net/ubuntu/xenial)

## Related threats

- [APT package manager hard link reuse remote code execution](https://junglewise.ai/threats/cve-2026-109518-on-debian-ubuntu-and-derivative-linux-distributions-an-on-path)
- [Canonical snapd privilege escalation in snap-confine](https://junglewise.ai/threats/cve-2026-8933-canonical-snapd-privilege-escalation-in-snap-confine)
- [Canonical snapd sandbox confinement bypass in snap-confine](https://junglewise.ai/threats/cve-2026-15226-canonical-snapd-sandbox-confinement-bypass-in-snap-confine)
- [Canonical ubuntu-pro-client code execution via APT source injection](https://junglewise.ai/threats/cve-2026-11386-canonical-ubuntu-pro-client-code-execution-via-apt-source)
- [Canonical ADSys trust store poisoning in AD CS auto-enrollment](https://junglewise.ai/threats/cve-2026-12249-canonical-adsys-trust-store-poisoning-in-ad-cs-auto-enrollment)