CVE-2026-41045: qSnapper Authentication Bypass Vulnerability

CVE-2026-41045 Overview

CVE-2026-41045 is a Time-of-Check Time-of-Use (TOCTOU) race condition in the polkit authentication logic of qSnapper before version 1.3.3. A local attacker can exploit the race window between the authentication check and the privileged operation to bypass qSnapper's authentication mechanism. Successful exploitation allows the attacker to operate as the root user through the qSnapper D-Bus service. The flaw is tracked under CWE-367 and was analyzed in the openSUSE Security Analysis.

Critical Impact
Local attackers can bypass polkit authentication in qSnapper and execute privileged snapshot operations as root, compromising system confidentiality, integrity, and availability.

Affected Products

qSnapper versions prior to 1.3.3
openSUSE distributions packaging vulnerable qSnapper builds
SUSE Linux systems with qSnapper installed (see SUSE Bug Report #1261795)

Discovery Timeline

2026-06-22 - CVE-2026-41045 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-41045

Vulnerability Analysis

The vulnerability resides in qSnapper's privileged D-Bus interface, which relies on polkit to authorize sensitive snapshot operations. Polkit identifies callers by process identifier (PID) when evaluating authorization rules. qSnapper checks the caller's identity and then performs the privileged action in two separate steps. An attacker can race the kernel between these steps to substitute a different process identity for the authorized one. The result is that an unprivileged local process can convince qSnapper that an authorized caller requested the action.

Root Cause

The root cause is a classic TOCTOU defect [CWE-367] in the polkit interaction path. qSnapper queries polkit to validate the caller, then issues the privileged operation without re-binding the authorization to the original process. Process identifiers are not stable security boundaries because they can be recycled after a process exits. An attacker who exits and rapidly forks a controlled process can reuse the PID that qSnapper believes is authorized.

Attack Vector

Exploitation requires local access and the ability to issue D-Bus method calls to the qSnapper service. The attacker invokes a privileged qSnapper method while a helper process holds an authorized PID. The helper exits at the precise moment qSnapper completes the polkit check, and an unprivileged process inherits the recycled PID before the privileged action executes. The race window is narrow, but it is repeatable with standard scheduler manipulation. Technical details are documented in the openSUSE Security Analysis and the upstream fix is published in the GitHub Release v1.3.3.

No verified public proof-of-concept code is available. See the upstream advisory for technical reproduction details.

Detection Methods for CVE-2026-41045

Indicators of Compromise

Unexpected root-owned Btrfs snapshots created outside scheduled qSnapper jobs or by non-administrative sessions
Rapid fork()/exit() patterns from unprivileged users immediately preceding qSnapper D-Bus method calls
Polkit authorization grants for qSnapper actions originating from short-lived processes with reused PIDs

Detection Strategies

Audit polkitd logs for qSnapper authorization decisions correlated with the calling PID, UID, and process lifetime
Instrument the D-Bus daemon to log method calls to the qSnapper bus name alongside originating credentials
Hunt for unprivileged users invoking qSnapper privileged methods that succeed without an interactive desktop session

Monitoring Recommendations

Enable auditd rules for execve and clone syscalls from users who can reach the qSnapper D-Bus interface
Monitor the qSnapper package version across the fleet to confirm upgrades to 1.3.3 or later
Alert on snapshot creation, deletion, or rollback events that lack a corresponding administrative session

How to Mitigate CVE-2026-41045

Immediate Actions Required

Upgrade qSnapper to version 1.3.3 or later using the vendor packages from the GitHub Release v1.3.3
Apply distribution updates referenced in SUSE Bug Report #1261795 on affected SUSE and openSUSE systems
Restrict local shell access on multi-user systems where qSnapper is installed until patches are applied

Patch Information

The upstream fix is included in qSnapper 1.3.3. The patched release replaces PID-based authorization with caller credentials obtained directly from the D-Bus connection, eliminating the TOCTOU window. Distribution maintainers have shipped rebuilt packages tracked under the referenced SUSE bug.

Workarounds

Disable or mask the qSnapper D-Bus service on systems where the snapshot functionality is not required
Limit polkit rules so only members of a trusted administrative group can invoke qSnapper actions, reducing the attacker surface
Remove the qSnapper package from shared or multi-tenant hosts until the upgrade to 1.3.3 is completed

bash

# Verify the installed qSnapper version and upgrade on openSUSE / SUSE
rpm -q qSnapper
sudo zypper refresh
sudo zypper update qSnapper
# Confirm the fixed version is in place
qSnapper --version  # expect 1.3.3 or later