CVE-2026-6369
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
36/100
Published: 2026-04-20
Modified: 2026-10-26
First seen: 2026-10-29
Status: active
Attack Surface
Low Complexity
No Interaction
Conf. Impact
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
Low
UI:
None
S:
X
AT:
Present
VC:
High
VI:
None
VA:
None
Description
An improper access control vulnerability in the canonical-livepatch snap client prior to version 10.15.0 allows a local unprivileged user to obtain a sensitive, root-level authentication token by sending an unauthenticated request to the livepatchd.sock Unix domain socket. This vulnerability is exploitable on systems where an administrator has already enabled the Livepatch client with a valid Ubuntu Pro subscription. This token allows an attacker to access Livepatch services using the victim's credentials, as well as potentially cause issues to the Livepatch server.
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| canonical | livepatch_client | < 10.15.0 |
References & Advisories (1)
Mitigation
Vendor Advisory