Read the docs
TI-2026-26401 Aliases CVE-2026-34078

Flatpak has a complete sandbox escape leading to host file access and code execution in the host context

Priority MEDIUM 51CWE-61Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in 1.16.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01709 77th percentileScored 2026-11-07
Fix Fixed flatpak (flatpak): 1.16.4Red Hat: 11 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
flatpakflatpakbefore 1.16.41.16.4Patch availableCNA
  • flatpak Vendorflatpak Affected before 1.16.4 Fixed in 1.16.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:flatpak:flatpak:*:*:*:*:*:*:*:*up to 1.16.3Vulnerableflatpak
  • cpe:2.3:a:flatpak:flatpak:*:*:*:*:*:*:*:* Versions up to 1.16.3 Vulnerable ·flatpak

Remediation

  • Fix · CNA flatpak (flatpak) Fixed in 1.16.4

Red Hat 11 advisories

  • RHSA-2026:35843 Released 2026-07-06 · Red Hat rating Important
    flatpak security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) flatpak-1.12.9-3.el7_9, flatpak-libs-1.12.9-3.el7_9
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) flatpak-builder-1.0.0-16.el7_9, flatpak-devel-1.12.9-3.el7_9
  • RHSA-2026:30901 Released 2026-06-29 · Red Hat rating Important
    flatpak security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) flatpak-1.12.9-2.el8_4, flatpak-libs-1.12.9-2.el8_4, flatpak-selinux-1.12.9-2.el8_4 +1
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) flatpak-1.12.9-2.el8_4, flatpak-libs-1.12.9-2.el8_4, flatpak-selinux-1.12.9-2.el8_4 +1
  • RHSA-2026:25381 Released 2026-06-11 · Red Hat rating Important
    flatpak security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) flatpak-1.12.9-1.el8_6, flatpak-libs-1.12.9-1.el8_6, flatpak-selinux-1.12.9-1.el8_6 +1
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) flatpak-1.12.9-1.el8_6, flatpak-libs-1.12.9-1.el8_6, flatpak-selinux-1.12.9-1.el8_6 +1
Show 8 more Red Hat advisories
  • RHSA-2026:25068 Released 2026-06-10 · Red Hat rating Important
    flatpak security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) flatpak-1.12.9-1.el8_8, flatpak-libs-1.12.9-1.el8_8, flatpak-selinux-1.12.9-1.el8_8 +1
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) flatpak-1.12.9-1.el8_8, flatpak-libs-1.12.9-1.el8_8, flatpak-selinux-1.12.9-1.el8_8 +1
  • RHSA-2026:23417 Released 2026-06-04 · Red Hat rating Important
    flatpak security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) flatpak-1.12.9-3.el9_4.1, flatpak-libs-1.12.9-3.el9_4.1, flatpak-selinux-1.12.9-3.el9_4.1 +1
  • RHSA-2026:23418 Released 2026-06-04 · Red Hat rating Important
    flatpak security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) flatpak-1.12.9-4.el9_6.1, flatpak-devel-1.12.9-4.el9_6.1, flatpak-session-helper-1.12.9-4.el9_6.1
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) flatpak-1.12.9-4.el9_6.1, flatpak-libs-1.12.9-4.el9_6.1, flatpak-selinux-1.12.9-4.el9_6.1 +1
  • RHSA-2026:23419 Released 2026-06-04 · Red Hat rating Important
    flatpak security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) flatpak-1.12.7-5.el9_2.1, flatpak-libs-1.12.7-5.el9_2.1, flatpak-selinux-1.12.7-5.el9_2.1 +1
  • RHSA-2026:23420 Released 2026-06-04 · Red Hat rating Important
    flatpak security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) flatpak-1.16.0-5.el10_0.2, flatpak-libs-1.16.0-5.el10_0.2, flatpak-selinux-1.16.0-5.el10_0.2 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) flatpak-devel-1.16.0-5.el10_0.2
  • RHSA-2026:21755 Released 2026-05-28 · Red Hat rating Important
    flatpak security update
    • Red Hat Enterprise Linux AppStream (v. 9) flatpak-1.12.9-4.el9_8.1, flatpak-libs-1.12.9-4.el9_8.1, flatpak-selinux-1.12.9-4.el9_8.1 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) flatpak-1.12.9-4.el9_8.1, flatpak-devel-1.12.9-4.el9_8.1, flatpak-session-helper-1.12.9-4.el9_8.1
  • RHSA-2026:21757 Released 2026-05-28 · Red Hat rating Important
    flatpak security update
    • Red Hat Enterprise Linux AppStream (v. 10) flatpak-1.16.0-9.el10_2.1, flatpak-libs-1.16.0-9.el10_2.1, flatpak-selinux-1.16.0-9.el10_2.1 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) flatpak-devel-1.16.0-9.el10_2.1
  • RHSA-2026:21756 Released 2026-05-28 · Red Hat rating Important
    flatpak security update
    • Red Hat Enterprise Linux AppStream (v. 8) flatpak-1.12.9-4.el8_10, flatpak-libs-1.12.9-4.el8_10, flatpak-selinux-1.12.9-4.el8_10 +1
    • Red Hat Enterprise Linux CRB (v. 8) flatpak-1.12.9-4.el8_10, flatpak-devel-1.12.9-4.el8_10, flatpak-session-helper-1.12.9-4.el8_10

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:23418
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:21757
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:21756
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:21755
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:30901
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:25381
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:25068
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:23419
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:23417
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:23420
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:23418
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:30901
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:25381
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:25068
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:21756
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:21757
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:21755
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:23420
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2026:35843
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2026:35843

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34078

References

Advisory 3

  • TI-2024-28440 Flatpak may allow access to files outside sandbox for certain apps CVSS 3.1CRITICAL 10.0
  • TI-2023-12679 TIOCLINUX can send commands outside sandbox if running on a virtual console CVSS 3.1CRITICAL 10.0
  • TI-2026-26402 Flatpak affected by arbitrary file deletion on the host filesystem CVSS 4.0HIGH 8.7
  • TI-2019-07389 Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a… CVSS 3.0CRITICAL 9.0
  • TI-2021-19666 Permissions granted to applications can be hidden from the user at install time CVSS 3.1HIGH 8.6
  • TI-2021-17972 Sandbox bypass via recent VFS-manipulating syscalls CVSS 3.1HIGH 8.8
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences