CVE-2026-41047: qSnapper Information Disclosure Flaw

CVE-2026-41047 Overview

CVE-2026-41047 is an information disclosure vulnerability in qSnapper, a graphical snapshot management tool for Btrfs filesystems on openSUSE. Versions prior to 1.3.3 fail to authenticate callers of the D-Bus snapshot diff functions. A local attacker can invoke these functions to read file contents from snapshots that would otherwise be protected by filesystem permissions. The flaw is categorized under CWE-306: Missing Authentication for Critical Function. The issue was tracked in SUSE Bug Report #1261890 and disclosed in the openSUSE Security Issue Analysis.

Critical Impact
A local, unprivileged attacker can read confidentiality-protected files via the unauthenticated snapshot diff D-Bus interface in qSnapper before 1.3.3.

Affected Products

qSnapper versions prior to 1.3.3
openSUSE distributions packaging vulnerable qSnapper builds
Linux systems using qSnapper for Btrfs snapshot management

Discovery Timeline

2026-06-22 - CVE-2026-41047 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-41047

Vulnerability Analysis

qSnapper exposes snapshot management functionality through a D-Bus service. The service handles requests to compare two filesystem snapshots through snapshot diff operations. Before version 1.3.3, the diff handlers did not verify the identity or privileges of the calling client. Any local process able to reach the D-Bus interface could request diffs across snapshots, including snapshots containing files outside the caller's normal read permissions. The diff output reveals file contents and metadata, breaking the confidentiality boundary that filesystem ACLs would normally enforce.

Root Cause

The root cause is missing authentication on a privileged D-Bus method, classified as [CWE-306]. The qSnapper daemon runs with elevated privileges so it can access snapshot data regardless of the requesting user. The diff functions inherited those privileges without enforcing a Polkit check or equivalent caller validation. As a result, the daemon performed protected reads on behalf of unprivileged callers and returned the results without filtering.

Attack Vector

Exploitation requires local access to the system and the ability to send messages to the qSnapper D-Bus service. An attacker with an interactive or remote shell session sends a crafted D-Bus method call to invoke the snapshot diff function against two snapshots that contain sensitive files. The daemon executes the diff with its own elevated privileges and returns content the caller would not otherwise be authorized to read. No user interaction and no prior privilege are required. Technical details are documented in the openSUSE Security Issue Analysis.

Detection Methods for CVE-2026-41047

Indicators of Compromise

D-Bus method calls to the qSnapper service originating from non-administrative user sessions
Unexpected snapshot diff invocations against snapshots containing system or user-private files
qSnapper process activity reading files outside the invoking user's accessible paths

Detection Strategies

Audit D-Bus traffic with dbus-monitor or system-bus logging to capture calls to the qSnapper interface
Enable Linux auditd rules on the qSnapper binary to record file access tied to diff operations
Correlate qSnapper daemon file reads with the UID of the originating D-Bus client to identify privilege boundary crossings

Monitoring Recommendations

Track installed qSnapper package versions across endpoints and flag any host below 1.3.3
Alert on local users invoking qSnapper D-Bus methods outside expected administrative workflows
Review snapshot access logs for read patterns inconsistent with normal backup or rollback activity

How to Mitigate CVE-2026-41047

Immediate Actions Required

Upgrade qSnapper to version 1.3.3 or later on all affected systems
Restrict local shell access on hosts running vulnerable qSnapper builds until patching is complete
Review snapshots for sensitive content that may have been exposed and rotate any disclosed secrets

Patch Information

The vendor fix is published in qSnapper GitHub Release v1.3.3. The release adds authentication checks to the D-Bus snapshot diff handlers so the daemon validates the caller before performing privileged reads. Distribution-specific updates are tracked in SUSE Bug Report #1261890.

Workarounds

Stop and disable the qSnapper D-Bus service on systems that cannot be patched immediately
Apply D-Bus policy rules in /etc/dbus-1/system.d/ to restrict access to the qSnapper interface to administrative users
Limit local logon rights on hosts where qSnapper must remain running until the update is deployed

bash

# Configuration example
# Verify installed qSnapper version and upgrade on openSUSE
rpm -q qSnapper
sudo zypper refresh
sudo zypper update qSnapper

# Confirm version is 1.3.3 or later
qsnapper --version