# CVE-2026-41045: presire qSnapper Polkit authentication bypass via TOCTOU race condition

Source: https://junglewise.ai/threats/cve-2026-41045-presire-qsnapper-polkit-authentication-bypass-via-toctou-race  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-41045 · Severity: high · CVSS 8.1 · Published 2026-06-22

qSnapper, a tool used to manage system snapshots on Linux, contains a security flaw in how it verifies user identity. A local attacker could exploit a timing issue to trick the system into granting them administrative (root) privileges. This could allow an unauthorized user to take full control of the computer, access sensitive files, or disrupt system operations.

Technologies: [Presire qSnapper](https://junglewise.ai/threats/technologies/qsnapper). Vendors: [Presire](https://junglewise.ai/threats/vendors/presire).

## Quick answers

**Is CVE-2026-41045 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41045 being exploited in the wild.

**How severe is CVE-2026-41045?** High severity, with a CVSS score of 8.1, published 22 June 2026.

**Which products and versions are affected?** Presire qSnapper < 1.3.3.

**Is there a fix for CVE-2026-41045?** A patch was published on 2026-05-25: Upstream release 1.3.3 published with fixes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41045 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-41045?** Check whether you run Presire qSnapper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A TOCTOU (Time-of-Check Time-of-Use) vulnerability exists in qSnapper's D-Bus service before version 1.3.3. The `SnapshotOperations::checkAuthorization()` function utilizes Polkit's `UnixProcess` subject, which relies on PIDs for authentication. Because PIDs can be recycled, a local attacker can initiate a request and, through a race condition, ensure that by the time `polkitd` checks the requester's identity, the PID has been reassigned to a privileged process. This allows the attacker to bypass Polkit policies and execute D-Bus methods as root. The issue was resolved in version 1.3.3 by migrating to the race-free `SystemBusName` subject.

## Affected products

- presire qSnapper < 1.3.3

## Timeline

- 2026-04-09: disclosed: Initial discovery and internal reporting by SUSE security team.
- 2026-05-25: patched: Upstream release 1.3.3 published with fixes.
- 2026-06-22: advisory: CVE-2026-41045 published to NVD.

## References

- [https://bugzilla.suse.com/show_bug.cgi?id=1261795](https://bugzilla.suse.com/show_bug.cgi?id=1261795)
- [https://github.com/presire/qSnapper/releases/tag/v1.3.3](https://github.com/presire/qSnapper/releases/tag/v1.3.3)
- [https://security.opensuse.org/2026/05/26/qsnapper-dbus-issues.html](https://security.opensuse.org/2026/05/26/qsnapper-dbus-issues.html)

## Related threats

- [presire qSnapper authentication bypass via shared auth caching](https://junglewise.ai/threats/cve-2026-41049-presire-qsnapper-authentication-bypass-via-shared-auth-caching)
- [presire qSnapper authentication bypass via shared m_authenticated flag](https://junglewise.ai/threats/cve-2026-41048-presire-qsnapper-authentication-bypass-via-shared-m-authenticated)
- [presire qSnapper information disclosure in snapshot diff functions](https://junglewise.ai/threats/cve-2026-41047-presire-qsnapper-information-disclosure-in-snapshot-diff)
- [presire qSnapper path traversal in configName parameter](https://junglewise.ai/threats/cve-2026-41046-presire-qsnapper-path-traversal-in-configname-parameter)