CVE-2026-15226: Canonical snapd sandbox confinement bypass in snap-confine

CVE-2026-15226 · Severity: high · CVSS 8.4 · Published 2026-07-21

A security vulnerability has been identified in snapd, the software manager used in Ubuntu and other Linux distributions to run applications in isolated 'sandboxes.' A flaw in how the system restricts program actions allows a malicious or compromised application to create special files that grant it elevated privileges. This could allow an attacker to bypass security boundaries, access sensitive data, or perform unauthorized actions on the host system that should normally be blocked.

Technologies: Canonical Snapd, Canonical Ubuntu. Vendors: Canonical.

Quick answers

Is CVE-2026-15226 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-15226 being exploited in the wild.
How severe is CVE-2026-15226?
High severity, with a CVSS score of 8.4, published 21 July 2026.
Which products and versions are affected?
Canonical Snapd < 2.76.1; Canonical Ubuntu < 2.76+ubuntu26.04.3.
Is there a fix for CVE-2026-15226?
A patch was published on 2026-07-21. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-15226 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-15226?
Check whether you run Canonical Snapd or Canonical Ubuntu at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A sandbox confinement bypass vulnerability exists in Canonical snapd's 'snap-confine' component. The root cause is a deficiency in the generated seccomp security templates, which fail to block system calls that create or modify files with set-user-ID (setuid) attributes. A local attacker or a compromised process within a strictly confined snap can exploit this by dropping or compiling a binary and applying setuid properties to it. Upon execution, this binary allows the process to bypass architectural sandboxing assumptions and execute privileged actions within the container namespace. The issue is resolved in snapd version 2.76.1 and corresponding Ubuntu package updates by hardening the seccomp engine to block setuid operations.

Affected products

  • Canonical snapd < 2.76.1
  • Canonical Ubuntu 26.04 LTS < 2.76+ubuntu26.04.3
  • Canonical Ubuntu 24.04 LTS < 2.76+ubuntu24.04.1
  • Canonical Ubuntu 22.04 LTS < 2.76+ubuntu22.04.1
  • Canonical Ubuntu 20.04 LTS < 2.67.1+20.04ubuntu1~esm2
  • Canonical Ubuntu 18.04 LTS < 2.61.4ubuntu0.18.04.1+esm3

Timeline

  • 2026-07-21: disclosed
  • 2026-07-21: advisory
  • 2026-07-21: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.