There are some exploits that allow for gaining root access.

One that comes to mind is dirty sock[0]. It uses a vulnerability in the snap api to create a root user.

https://github.com/initstring/dirty_sock/blob/master/dirty_s...