Polkit qSnapper CVE-2026-41045-49 Analysis: Auth Bypass, Path Traversal, Info Disclosure

Vulnerability Overview CVE-2026-41045: Polkit authentication bypass via abuse of . CVE-2026-41046: Path traversal via leading to local DoS and information leakage. CVE-2026-41047: Information leakage via operations, accessible without administrator authentication. CVE-2026-41048: Authentication bypass for D-Bus clients sharing the flag. CVE-2026-41049: Authentication bypass via implicit inheritance between different Polkit actions. Affected Scope All users running qSnapper version 1.3.3. Involves critical components such as D-Bus services, Polkit authentication mechanisms, and configuration file handling. Remediation Plan P0 - Immediately Block Local Root Privilege Escalation Replace with in Polkit's to close the PID reuse race condition. Remove the cache and the D-Bus method; rely on Polkit's behavior instead. Add a string validation function (allowlist: ) and apply it at the entry point of every D-Bus method that accepts . Merge into a single hardened ; require absolute paths, reject , use with , and validate within the snapshot root path. P1 - Split diff Authorization, Remove Quit D-Bus Method, Harden Log Permissions Introduce a new Polkit action with ; move , , , and under it, restricting authorization to snapshot enumeration only. Remove the D-Bus method (no authentication check, DoS vector); service shutdown now relies solely on the existing 5-minute idle timer. Harden permissions for : directory set to , log files set to , enforced via drop-ins and runtime . P2 - Enforce Per-Member D-Bus ACLs Replace the "allow all to destination" D-Bus policy with member-based ACLs, allowing only the 15 declared public methods plus and . is intentionally denied because the service exposes no D-Bus properties. P3 - Address Review Comments (SUSE Round 2 Feedback) Extend to reject all Unicode control ranges: C0 (U+0000..U+001F), DEL (U+007F), and C1 (U+0080..U+009F). Remove redundant calls to from , as the allowlist regex already covers them. Rewrite to use direct string prefix comparison with boundary checks, replacing lexical relative path hacks and preventing sibling-root issues. Rename to and collapse the "empty -> root" default, eliminating inconsistent checks at each call site. Downgrade log priority for recovery operations from to (systemd log priority 6). Move the emission past the input validation for each element, ensuring D-Bus progress signals cannot carry unaccepted caller paths. Update inline documentation and Doxygen comments. License Change The project license has been realigned from GPL-3.0 to GPL-2.0-or-later to match libkf5su (LGPL-2.1) linking requirements. License headers and packaging metadata have been updated accordingly. This change is independent of the security review and has no security impact. Known Limitations (Documented as v1.3.4 Follow-up) TOCTOU issue in (known / file creation targeting parent directories controlled by the service user) is tracked as an open issue for v1.3.4 to be resolved after the coordinated release. This is a defense-in-depth issue, relevant only when the service account has already been compromised. Full Changelog v1.3.2..v1.3.3 Assets No POC code or exploit code is provided.

Goal Reached Thanks to every supporter — we hit 100%!

Polkit qSnapper CVE-2026-41045-49 Analysis: Auth Bypass, Path Traversal, Info Disclosure

More from this source