CVE-2026-8933

A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure execution environment for snap applications. This vulnerability uniquely affects versions of snap-confine configured with set-capabilities (rather than standard set-uid-root installations). Due to a flaw in how privilege boundaries or security sandboxes are initialized when the binary runs under limited ambient capabilities, a local, unprivileged attacker can exploit this behavior to bypass intended restrictions and execute arbitrary code. Successful exploitation allows the local user to elevate their privileges to full root authority.

• CWE-250

• https://ubuntu.com/security/CVE-2026-8933

Published

Jul 21, 2026

Last Modified

Jul 21, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8932libcurl would reuse a previously created connection even whe…7.5
• CVE-2026-89321Publishing limits the compressed size of a VSIX (ovsx.publis…4.3
• CVE-2026-89325An uncontrolled search path element in InsightVM assessment …7.8
• CVE-2026-89327The FluentBoards WordPress plugin before 2.0.15 does not ve…3.8
• CVE-2026-89328The FluentBoards WordPress plugin before 2.0.15 does not pr…3.8
• CVE-2026-89329A flaw was found in `multipathd`. A local attacker with acce…6.2
• CVE-2026-89330The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Revie…6.1
• CVE-2026-89331The FluentBoards WordPress plugin before 2.1.0 does not pro…5.3
• CVE-2026-89332Inclusion of functionality from an untrusted control sphere …5.5
• CVE-2026-89333The Tutor LMS – eLearning and online course solution plugin …6.5
• CVE-2026-89334The Better Messages – Chat Rooms, Group Chat, Private Messag…6.5
• CVE-2026-8934A Missing Authorization vulnerability in a GraphQL private A…6.9