PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-41049 presire CVE debrief

The qSnapper dbus service before version 1.3.3 incorrectly cached authentication between different users, allowing any local attacker to use dbus functions after a privileged user has authenticated for them. This vulnerability has a CVSS score of 8.4 and is classified as HIGH severity. The CVE was published on 2026-06-22T16:16:35.413Z and modified on 2026-06-22T18:32:57.313Z. The vendor is listed as Unknown Vendor, but evidence suggests a potential connection to Suse. The vulnerability is related to CWE-303. There are multiple sources referencing this issue, including the CVE.org record, NVD detail, and several source references.

Vendor
presire
Product
qSnapper
CVSS
HIGH 8.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-22
Original CVE updated
2026-07-08
Advisory published
2026-06-22
Advisory updated
2026-07-08

Who should care

System administrators and security teams responsible for managing and securing systems that utilize the qSnapper dbus service should be aware of this vulnerability. Specifically, those using Suse-based systems or the qSnapper service should assess their exposure and apply necessary patches or mitigations. The vulnerability's high severity and local attack vector make it a priority for immediate attention.

Technical summary

The qSnapper dbus service, prior to version 1.3.3, failed to properly cache authentication between different users. This flaw allowed any local attacker to leverage dbus functions after a privileged user had authenticated on their behalf. The vulnerability is characterized by a CVSS:4.0 vector of AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. The issue is associated with CWE-303, Improper Authentication. The CVE-2026-41049 record and NVD detail provide further technical insights into this vulnerability.

Defensive priority

High priority should be given to patching or mitigating this vulnerability due to its high CVSS score and local attack vector. System administrators should verify that the qSnapper dbus service version 1.3.3 or later is deployed to prevent exploitation.

Recommended defensive actions

  • Apply the patch or update to qSnapper dbus service version 1.3.3 or later.
  • Verify and restrict access to dbus functions to only necessary users and services.
  • Monitor system logs for suspicious dbus activity.
  • Implement additional authentication mechanisms for dbus services where possible.
  • Conduct a thorough inventory of systems and services that may be affected by this vulnerability.

Evidence notes

The CVE-2026-41049 record and associated sources provide evidence of the vulnerability's existence and details. The NVD detail and CVE.org record offer official validation of the issue. Additional source references, including bug reports and release notes, support the technical summary and recommended actions. However, some details about the vendor and affected products are unclear or listed as 'Unknown Vendor', suggesting a need for further investigation and verification.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-41049 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-41049

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-41049 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-41049

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.