CVE-2026-6369

CVE-2026-6369 is an improper access control vulnerability affecting the canonical-livepatch snap client prior to version 10.15.0. This flaw allows unprivileged local users to obtain root-level authentication tokens through unauthenticated requests to the livepatchd.sock Unix domain socket on systems with Livepatch enabled and a valid Ubuntu Pro subscription. The vulnerability is relevant to Ubuntu systems where Livepatch has been administratively deployed. An attacker exploiting this vulnerability could impersonate the victim, access Livepatch services using their credentials, and potentially disrupt or manipulate the Livepatch server. The attack vector is local and does not require authentication or user interaction, making it accessible to any unprivileged user on an affected system. Current threat assessment indicates no active exploitation in the wild, as the vulnerability is not included in CISA's Known Exploited Vulnerabilities catalog and maintains an inactive status on threat tracking lists. The FAUCET risk score of 42.0/100 suggests moderate concern requiring patching through upgrade to version 10.15.0 or later, though the extremely low EPSS score of 0.00017 indicates limited prevalence in exploit activity across the broader threat landscape.