An improper access control flaw in the Canonical Livepatch client snap allows a local unprivileged user to retrieve a root authentication token by sending an unauthenticated request to the livepatchd.sock Unix domain socket. The compromised token grants the attacker full access to Livepatch services running on the host with the victim’s credentials, potentially enabling unauthorized patching or other privileged operations. The flaw arises from missing authentication checks (CWE-306) and incorrect permission assignments (CWE-732).

All Ubuntu systems running the canonical-livepatch snap client older than version 10.15.0 with Livepatch enabled and a valid Ubuntu Pro subscription. The vulnerability exists in the snap package delivered by Canonical.

The CVSS score of 5.7 indicates a medium overall severity. Exploitation requires local, non-privileged access; no remote vector is available. EPSS data is not provided, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not currently broadly exploited. However, once the token is acquired, the attacker can perform high-impact privileged operations, and the presence of a valid subscription increases the attacker's motivation. The only prerequisite is a user with local access on a system where Livepatch is activated.