Skip to content
Fencer Vulns
high 8.4

CVE-2026-15226 json

snapd snap-confine Sandbox Confinement Bypass via Omission of setuid Restriction in Seccomp Templates

published 2026-07-21 3 mo ago modified 2026-07-22 3 mo ago also EUVD-2026-46261

cvss
8.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 8%
public exploits
0
none known

Summary

A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler (snap-confine). The default seccomp security templates generated by the engine to restrict system calls do not filter or reject process operations capable of creating or manipulating file execution flags with set-user-ID attributes. Consequently, an application running within a strictly confined snap environment can successfully compile or drop binaries and apply setuid properties to them. If a compromised or malicious process inside the snap sandbox executes these generated setuid binaries, it can potentially circumvent architectural sandboxing assumptions, drop intended restriction policies, or execute privileged actions inside the container namespace that should otherwise be strictly blocked. The vulnerability has been resolved by hardening the seccomp template engine to block the execution and creation of setuid executables by sandboxed snap processes.

Patch / fix

  • Canonical Ubuntu 26.04 LTS 2.76+ubuntu26.04.3
  • Canonical Ubuntu 24.04 LTS 2.76+ubuntu24.04.1
  • Canonical Ubuntu 22.04 LTS 2.76+ubuntu22.04.1
  • Canonical Ubuntu 20.04 LTS 2.67.1+20.04ubuntu1~esm2
  • Canonical Ubuntu 18.04 LTS 2.61.4ubuntu0.18.04.1+esm3
  • Canonical Ubuntu 16.04 LTS 2.61.4ubuntu0.16.04.1+esm3
  • snapd Debian 14 2.76.3-1

debian advisories DEBIAN-CVE-2026-15226

  • snapd Ubuntu 22.04 LTS 2.76+ubuntu22.04.1
  • snapd Ubuntu 24.04 LTS 2.76+ubuntu24.04.1
  • snapd Ubuntu 26.04 LTS 2.76+ubuntu26.04.3
  • snapd Ubuntu Pro 16.04 LTS 2.61.4ubuntu0.16.04.1+esm4
  • snapd Ubuntu Pro 18.04 LTS 2.61.4ubuntu0.18.04.1+esm4
  • snapd Ubuntu Pro 20.04 LTS 2.67.1+20.04ubuntu1~esm3

ubuntu advisories UBUNTU-CVE-2026-15226

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-15226 updated cvss 8.4

snapd: snapd: Sandbox Confinement Bypass and Privilege Escalation

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
3 mo ago

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Affected products

  • Canonical Ubuntu 26.04 LTS
  • Canonical Ubuntu 24.04 LTS
  • Canonical Ubuntu 22.04 LTS
  • Canonical Ubuntu 20.04 LTS
  • Canonical Ubuntu 18.04 LTS
  • Canonical Ubuntu 16.04 LTS

Classification

Weakness
  • CWE-250 Execution with Unnecessary Privileges

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.