The canonical-livepatch snap client prior to version 10.15.0 contains a missing authentication vulnerability (CWE-306) that allows local unprivileged users to send unauthenticated requests to the livepatchd.sock Unix domain socket. This leads to disclosure of a root-level authentication token if the Livepatch client is enabled with a valid Ubuntu Pro subscription. The token grants access to Livepatch services under the victim's credentials and may cause issues to the Livepatch server. The vulnerability is local attack vector with low attack complexity and requires partial user interaction (privileged user enabling Livepatch). No vendor advisory or patch information is currently available.

An attacker with local unprivileged access on a system running a vulnerable version of canonical-livepatch can obtain a root-level authentication token. This token enables unauthorized access to Livepatch services using the victim's credentials and may allow the attacker to interfere with Livepatch server operations. The impact is limited to systems with Livepatch enabled and a valid Ubuntu Pro subscription. There is no indication of remote exploitation or widespread active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to systems running vulnerable versions of canonical-livepatch and monitor for unauthorized local activity. Avoid enabling Livepatch on systems where local user access cannot be fully trusted.