A new Ubuntu security notice was published for authd, affecting Ubuntu 26.04 LTS. The issue is tracked as CVE-2026-6970.
The vulnerability can allow a local attacker to possibly escalate privileges or gain unauthorized access to files belonging to other users.
What is authd?
authd is an authentication daemon developed for Ubuntu. It is designed to integrate Ubuntu systems with cloud-based identity providers, such as Microsoft Entra ID and Google Cloud IAM.
Canonical describes authd as an authentication daemon for Ubuntu Desktop and Ubuntu Server that helps manage identity and access on Ubuntu machines.
What happened?
According to Ubuntu Security Notice USN-8212-1, authd incorrectly assigned the primary group ID to users under certain conditions.
This could allow a local attacker to:
- escalate privileges
- gain unauthorized access to files owned by other users
- abuse incorrect user/group permissions