Read the docs
TI-2026-26402 Aliases CVE-2026-34079

Flatpak affected by arbitrary file deletion on the host filesystem

Priority MEDIUM 44CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-22 and the CVSS impact.

Summary

Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00328 26th percentileScored 2026-11-07
Fix Fixed flatpak (flatpak): 1.16.4Red Hat: 11 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
flatpakflatpakbefore 1.16.41.16.4Patch availableCNA
  • flatpak Vendorflatpak Affected before 1.16.4 Fixed in 1.16.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:flatpak:flatpak:*:*:*:*:*:*:*:*before 1.16.4Vulnerableflatpak
  • cpe:2.3:a:flatpak:flatpak:*:*:*:*:*:*:*:* Versions before 1.16.4 Vulnerable ·flatpak

Remediation

  • Fix · CNA flatpak (flatpak) Fixed in 1.16.4

Red Hat 11 advisories

  • RHSA-2026:35843 Released 2026-07-06 · Red Hat rating Important
    flatpak security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) flatpak-1.12.9-3.el7_9, flatpak-libs-1.12.9-3.el7_9
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) flatpak-builder-1.0.0-16.el7_9, flatpak-devel-1.12.9-3.el7_9
  • RHSA-2026:30901 Released 2026-06-29 · Red Hat rating Important
    flatpak security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) flatpak-1.12.9-2.el8_4, flatpak-libs-1.12.9-2.el8_4, flatpak-selinux-1.12.9-2.el8_4 +1
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) flatpak-1.12.9-2.el8_4, flatpak-libs-1.12.9-2.el8_4, flatpak-selinux-1.12.9-2.el8_4 +1
  • RHSA-2026:25381 Released 2026-06-11 · Red Hat rating Important
    flatpak security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) flatpak-1.12.9-1.el8_6, flatpak-libs-1.12.9-1.el8_6, flatpak-selinux-1.12.9-1.el8_6 +1
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) flatpak-1.12.9-1.el8_6, flatpak-libs-1.12.9-1.el8_6, flatpak-selinux-1.12.9-1.el8_6 +1
Show 8 more Red Hat advisories
  • RHSA-2026:25068 Released 2026-06-10 · Red Hat rating Important
    flatpak security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) flatpak-1.12.9-1.el8_8, flatpak-libs-1.12.9-1.el8_8, flatpak-selinux-1.12.9-1.el8_8 +1
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) flatpak-1.12.9-1.el8_8, flatpak-libs-1.12.9-1.el8_8, flatpak-selinux-1.12.9-1.el8_8 +1
  • RHSA-2026:23417 Released 2026-06-04 · Red Hat rating Important
    flatpak security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) flatpak-1.12.9-3.el9_4.1, flatpak-libs-1.12.9-3.el9_4.1, flatpak-selinux-1.12.9-3.el9_4.1 +1
  • RHSA-2026:23418 Released 2026-06-04 · Red Hat rating Important
    flatpak security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) flatpak-1.12.9-4.el9_6.1, flatpak-devel-1.12.9-4.el9_6.1, flatpak-session-helper-1.12.9-4.el9_6.1
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) flatpak-1.12.9-4.el9_6.1, flatpak-libs-1.12.9-4.el9_6.1, flatpak-selinux-1.12.9-4.el9_6.1 +1
  • RHSA-2026:23419 Released 2026-06-04 · Red Hat rating Important
    flatpak security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) flatpak-1.12.7-5.el9_2.1, flatpak-libs-1.12.7-5.el9_2.1, flatpak-selinux-1.12.7-5.el9_2.1 +1
  • RHSA-2026:23420 Released 2026-06-04 · Red Hat rating Important
    flatpak security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) flatpak-1.16.0-5.el10_0.2, flatpak-libs-1.16.0-5.el10_0.2, flatpak-selinux-1.16.0-5.el10_0.2 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) flatpak-devel-1.16.0-5.el10_0.2
  • RHSA-2026:21755 Released 2026-05-28 · Red Hat rating Important
    flatpak security update
    • Red Hat Enterprise Linux AppStream (v. 9) flatpak-1.12.9-4.el9_8.1, flatpak-libs-1.12.9-4.el9_8.1, flatpak-selinux-1.12.9-4.el9_8.1 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) flatpak-1.12.9-4.el9_8.1, flatpak-devel-1.12.9-4.el9_8.1, flatpak-session-helper-1.12.9-4.el9_8.1
  • RHSA-2026:21757 Released 2026-05-28 · Red Hat rating Important
    flatpak security update
    • Red Hat Enterprise Linux AppStream (v. 10) flatpak-1.16.0-9.el10_2.1, flatpak-libs-1.16.0-9.el10_2.1, flatpak-selinux-1.16.0-9.el10_2.1 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) flatpak-devel-1.16.0-9.el10_2.1
  • RHSA-2026:21756 Released 2026-05-28 · Red Hat rating Important
    flatpak security update
    • Red Hat Enterprise Linux AppStream (v. 8) flatpak-1.12.9-4.el8_10, flatpak-libs-1.12.9-4.el8_10, flatpak-selinux-1.12.9-4.el8_10 +1
    • Red Hat Enterprise Linux CRB (v. 8) flatpak-1.12.9-4.el8_10, flatpak-devel-1.12.9-4.el8_10, flatpak-session-helper-1.12.9-4.el8_10

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:23418
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:21757
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:21756
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:21755
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:30901
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:25381
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:25068
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:23419
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:23417
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:23420
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:23418
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:30901
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:25381
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:25068
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:21756
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:21757
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:21755
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:23420
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2026:35843
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2026:35843

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34079

References

Advisory 1

  • TI-2026-26401 Flatpak has a complete sandbox escape leading to host file access and code execution in the host context CVSS 4.0CRITICAL 9.3
  • TI-2024-28440 Flatpak may allow access to files outside sandbox for certain apps CVSS 3.1CRITICAL 10.0
  • TI-2023-12679 TIOCLINUX can send commands outside sandbox if running on a virtual console CVSS 3.1CRITICAL 10.0
  • TI-2019-07389 Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a… CVSS 3.0CRITICAL 9.0
  • TI-2021-19666 Permissions granted to applications can be hidden from the user at install time CVSS 3.1HIGH 8.6
  • TI-2021-17972 Sandbox bypass via recent VFS-manipulating syscalls CVSS 3.1HIGH 8.8
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences