# CVE-2026-3888: Canonical snapd privilege escalation via systemd-tmpfiles interaction

Source: https://junglewise.ai/threats/cve-2026-3888-canonical-snapd-privilege-escalation-via-systemd-tmpfiles  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-17. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2026-3888 · Severity: high · CVSS 7.8 · Published 2026-03-17

A vulnerability in snapd, the service that manages application packages (snaps) on Ubuntu Linux, allows a local user to gain full administrative (root) control of the system. The flaw occurs because of an interaction between the snap sandbox manager and a system cleanup utility that automatically deletes old temporary files. By waiting for the system to delete a specific directory and then replacing it with a malicious version, an attacker can trick the system into running their code with elevated privileges. This exploit requires significant time to execute (between 10 to 30 days) but results in a total compromise of the affected machine.

Technologies: [Canonical Snapd](https://junglewise.ai/threats/technologies/snapd). Vendors: [Canonical](https://junglewise.ai/threats/vendors/canonical).

## Quick answers

**Is CVE-2026-3888 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-3888 being exploited in the wild.

**How severe is CVE-2026-3888?** High severity, with a CVSS score of 7.8, published 17 March 2026.

**Which products and versions are affected?** Canonical Snapd prior to 2.73+ubuntu24.04.2.

**Is there a fix for CVE-2026-3888?** A patch was published on 2026-03-17: Patched versions released for Ubuntu LTS versions Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-3888 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-3888?** Check whether you run Canonical Snapd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Local Privilege Escalation (LPE) vulnerability exists in snapd due to an insecure interaction between snap-confine and systemd-tmpfiles. On Ubuntu 24.04 and later, systemd-tmpfiles is configured to automatically delete files in /tmp older than 10-30 days. An attacker can wait for this cleanup cycle to delete the /tmp/.snap directory within a snap's private namespace. Because the parent /tmp directory is world-writable, the attacker can recreate /tmp/.snap. When snap-confine subsequently sets up a snap sandbox, it performs bind-mounts into this attacker-controlled directory. By winning a race condition during the 'mimic' creation process, the attacker can force snap-confine to bind-mount malicious shared libraries into the sandbox's /usr/lib, leading to arbitrary code execution as root via SUID binaries. Patches are available in snapd versions 2.73+ and later.

## Affected products

- Canonical snapd prior to 2.73+ubuntu24.04.2
- Canonical snapd prior to 2.73+ubuntu25.10.1
- Canonical snapd prior to 2.74.1+ubuntu26.04.1
- upstream snapd snapd prior to 2.75
- Canonical Ubuntu Linux 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, 24.04 LTS, 25.10

## Timeline

- 2026-03-17: disclosed: Vulnerability disclosed by Qualys and Canonical
- 2026-03-17: patched: Patched versions released for Ubuntu LTS versions
- 2026-03-17: advisory

## References

- [https://blog.qualys.com/vulnerabilities-threat-research/2026/03/17/cve-2026-3888-important-snap-flaw-enables-local-privilege-escalation-to-root](https://blog.qualys.com/vulnerabilities-threat-research/2026/03/17/cve-2026-3888-important-snap-flaw-enables-local-privilege-escalation-to-root)
- [https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-systemd-tmpfiles.txt](https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-systemd-tmpfiles.txt)
- [https://discourse.ubuntu.com/t/snapd-local-privilege-escalation-cve-2026-3888](https://discourse.ubuntu.com/t/snapd-local-privilege-escalation-cve-2026-3888)
- [https://ubuntu.com/security/CVE-2026-3888](https://ubuntu.com/security/CVE-2026-3888)
- [https://ubuntu.com/security/notices/USN-8102-1](https://ubuntu.com/security/notices/USN-8102-1)
- [http://www.openwall.com/lists/oss-security/2026/03/18/1](http://www.openwall.com/lists/oss-security/2026/03/18/1)

## Related threats

- [Canonical snapd privilege escalation in snap-confine](https://junglewise.ai/threats/cve-2026-8933-canonical-snapd-privilege-escalation-in-snap-confine)
- [Canonical snapd sandbox confinement bypass in snap-confine](https://junglewise.ai/threats/cve-2026-15226-canonical-snapd-sandbox-confinement-bypass-in-snap-confine)
- [Canonical snapd access control bypass in AppArmor configuration](https://junglewise.ai/threats/cve-2024-5300-canonical-snapd-access-control-bypass-in-apparmor-configuration)