Description
An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd (inherited via ) inadvertently permit strictly confined snap applications, which lack the privileged account-control interface, to interact directly with the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets under /run/systemd/userdb/.
On systems where the systemd-userdbd service is installed and operational, the service fails to distinguish between an unconfined root user on the host system and a restricted root user running within a snap application's sandbox (such as a daemon or configuration hook). Because systemd-userdbd returns "complete" user records—including sensitive hashed user passwords from /etc/shadow—when queried by a process running as root, a compromised or malicious strictly confined snap executing code as root can successfully query the Varlink interface to retrieve all system password hashes, bypassing intended snap sandbox restrictions. This issue is mitigated by the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments.
Published: 2026-07-21
Score: 5.6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An AppArmor base profile misconfiguration in snapd allows strictly confined snap applications that run as root to interact with systemd-userdbd UNIX domain sockets. The service returns full user records, including hashed passwords from /etc/shadow, creating an information disclosure flaw identified as CWE-212 and CWE-1220.

Affected Systems

Canonical’s Ubuntu releases 16.04 LTS through 26.04 LTS are vulnerable when the systemd-userdbd service is installed and operational. The flaw is specific to systems that have snapd and the systemd-userdbd helper enabled; standard Ubuntu deployments do not include this service by default.

Risk and Exploitability

The CVSS base score of 5.6 indicates moderate severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. This flaw encompasses both an information disclosure (CWE-212) and an access control bypass (CWE-1220). The attack vector is local; an attacker must run a confined snap with root privileges on a system where systemd-userdbd is active to retrieve all system password hashes.

Generated by OpenCVE AI on August 3, 2026 at 00:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Disable or uninstall the systemd-userdbd service if it is not required for the host’s operation.
  • Apply the latest Ubuntu security updates that correct the snapd AppArmor profile controls.
  • Audit and, if necessary, re‑apply AppArmor abstractions to ensure that confined snaps cannot reach the io.systemd.Multiplexer and io.systemd.NameServiceSwitch sockets.

Generated by OpenCVE AI on August 3, 2026 at 00:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-8579-1 snapd vulnerabilities
History

Wed, 29 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1220
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Canonical
Canonical ubuntu
Vendors & Products Canonical
Canonical ubuntu

Wed, 22 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Description An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd (inherited via ) inadvertently permit strictly confined snap applications, which lack the privileged account-control interface, to interact directly with the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets under /run/systemd/userdb/. On systems where the systemd-userdbd service is installed and operational, the service fails to distinguish between an unconfined root user on the host system and a restricted root user running within a snap application's sandbox (such as a daemon or configuration hook). Because systemd-userdbd returns "complete" user records—including sensitive hashed user passwords from /etc/shadow—when queried by a process running as root, a compromised or malicious strictly confined snap executing code as root can successfully query the Varlink interface to retrieve all system password hashes, bypassing intended snap sandbox restrictions. This issue is mitigated by the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments.
Title AppArmor Base Profile Misconfiguration in snapd Permits Confined Snaps Unauthorized Access to Hashed Passwords via systemd-userdbd
Weaknesses CWE-212
References
Metrics cvssV3_1

{'score': 5.6, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

Canonical Ubuntu
cve-icon MITRE

Status: PUBLISHED

Assigner: canonical

Published:

Updated: 2026-07-22T18:28:16.818Z

Reserved: 2024-05-23T21:58:22.809Z

Link: CVE-2024-5300

cve-icon Vulnrichment

Updated: 2026-07-22T18:13:30.782Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-07-21T15:16:29.027

Modified: 2026-07-22T19:16:53.303

Link: CVE-2024-5300

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-21T14:00:51Z

Links: CVE-2024-5300 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T00:45:03Z

Weaknesses
  • CWE-1220

    Insufficient Granularity of Access Control

  • CWE-212

    Improper Removal of Sensitive Information Before Storage or Transfer