crítica
CVE-2026-34078
flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Red Hat9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Red Hat (alta), AlmaLinux (alta), Amazon (alta), Oracle (alta), Rocky Linux (alta), Ubuntu (media).
Descripción
Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in 1.16.4.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 10 | flatpak, flatpak-devel, flatpak-libs y 2 más | 1.16.0-9.el10_2.1 |
| alma 8 | flatpak, flatpak-devel, flatpak-libs y 2 más | 1.12.9-4.el8_10 |
| alma 9 | flatpak, flatpak-devel, flatpak-libs y 2 más | 1.12.9-4.el9_8.1 |
| alpine 3.23 | flatpak | 1.16.4-r0 |
| alpine 3.24 | flatpak | 1.16.4-r0 |
| alpine edge | flatpak | 1.16.4-r0 |
| amazon linux 2 | flatpak, flatpak-builder, flatpak-debuginfo y 2 más | 1.0.9-10.amzn2.0.7 y 1 más |
| amazon linux 2023 | flatpak, flatpak-debuginfo, flatpak-debugsource y 8 más | 1.16.6-1.amzn2023 |
| debian 11 | flatpak | sin corrección indicada |
| debian 12 | flatpak | 1.14.10-1~deb12u2 |
| debian 13 | flatpak | 1.16.6-1~deb13u1 |
| debian 14 | flatpak | 1.16.4-1 |
Mostrar las 110 entradas de 37 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 10 | flatpak | 1.16.0-9.el10_2.1 |
| alma 10 | flatpak-devel | 1.16.0-9.el10_2.1 |
| alma 10 | flatpak-libs | 1.16.0-9.el10_2.1 |
| alma 10 | flatpak-selinux | 1.16.0-9.el10_2.1 |
| alma 10 | flatpak-session-helper | 1.16.0-9.el10_2.1 |
| alma 8 | flatpak | 1.12.9-4.el8_10 |
| alma 8 | flatpak-devel | 1.12.9-4.el8_10 |
| alma 8 | flatpak-libs | 1.12.9-4.el8_10 |
| alma 8 | flatpak-selinux | 1.12.9-4.el8_10 |
| alma 8 | flatpak-session-helper | 1.12.9-4.el8_10 |
| alma 9 | flatpak | 1.12.9-4.el9_8.1 |
| alma 9 | flatpak-devel | 1.12.9-4.el9_8.1 |
| alma 9 | flatpak-libs | 1.12.9-4.el9_8.1 |
| alma 9 | flatpak-selinux | 1.12.9-4.el9_8.1 |
| alma 9 | flatpak-session-helper | 1.12.9-4.el9_8.1 |
| alpine 3.23 | flatpak | 1.16.4-r0 |
| alpine 3.24 | flatpak | 1.16.4-r0 |
| alpine edge | flatpak | 1.16.4-r0 |
| amazon linux 2 | flatpak | 1.0.9-10.amzn2.0.7 |
| amazon linux 2 | flatpak-builder | 1.0.0-10.amzn2.0.7 |
| amazon linux 2 | flatpak-debuginfo | 1.0.9-10.amzn2.0.7 |
| amazon linux 2 | flatpak-devel | 1.0.9-10.amzn2.0.7 |
| amazon linux 2 | flatpak-libs | 1.0.9-10.amzn2.0.7 |
| amazon linux 2023 | flatpak | 1.16.6-1.amzn2023 |
| amazon linux 2023 | flatpak-debuginfo | 1.16.6-1.amzn2023 |
| amazon linux 2023 | flatpak-debugsource | 1.16.6-1.amzn2023 |
| amazon linux 2023 | flatpak-devel | 1.16.6-1.amzn2023 |
| amazon linux 2023 | flatpak-libs | 1.16.6-1.amzn2023 |
| amazon linux 2023 | flatpak-libs-debuginfo | 1.16.6-1.amzn2023 |
| amazon linux 2023 | flatpak-selinux | 1.16.6-1.amzn2023 |
| amazon linux 2023 | flatpak-session-helper | 1.16.6-1.amzn2023 |
| amazon linux 2023 | flatpak-session-helper-debuginfo | 1.16.6-1.amzn2023 |
| amazon linux 2023 | flatpak-tests | 1.16.6-1.amzn2023 |
| amazon linux 2023 | flatpak-tests-debuginfo | 1.16.6-1.amzn2023 |
| debian 11 | flatpak | sin corrección indicada |
| debian 12 | flatpak | 1.14.10-1~deb12u2 |
| debian 13 | flatpak | 1.16.6-1~deb13u1 |
| debian 14 | flatpak | 1.16.4-1 |
| echo | flatpak | 1.14.10-1~deb12u2 |
| Oracle Linux 7 | flatpak | 1.12.9-4.0.1.el7 |
| Oracle Linux 7 | flatpak-builder | 1.0.0-17.0.1.el7 |
| Oracle Linux 7 | flatpak-devel | 1.12.9-4.0.1.el7 |
| Oracle Linux 7 | flatpak-libs | 1.12.9-4.0.1.el7 |
| Oracle Linux 8 | flatpak | 1.12.9-4.el8_10 |
| Oracle Linux 8 | flatpak-devel | 1.12.9-4.el8_10 |
| Oracle Linux 8 | flatpak-libs | 1.12.9-4.el8_10 |
| Oracle Linux 8 | flatpak-selinux | 1.12.9-4.el8_10 |
| Oracle Linux 8 | flatpak-session-helper | 1.12.9-4.el8_10 |
| Oracle Linux 9 | flatpak | 1.12.9-4.el9_8.1 |
| Oracle Linux 9 | flatpak-devel | 1.12.9-4.el9_8.1 |
| Oracle Linux 9 | flatpak-libs | 1.12.9-4.el9_8.1 |
| Oracle Linux 9 | flatpak-selinux | 1.12.9-4.el9_8.1 |
| Oracle Linux 9 | flatpak-session-helper | 1.12.9-4.el9_8.1 |
| rapidfort alma 10 | flatpak | 1.16.0-9.el10_2.1 |
| rapidfort alma 10 | flatpak-devel | 1.16.0-9.el10_2.1 |
| rapidfort alma 10 | flatpak-libs | 1.16.0-9.el10_2.1 |
| rapidfort alma 10 | flatpak-selinux | 1.16.0-9.el10_2.1 |
| rapidfort alma 10 | flatpak-session-helper | 1.16.0-9.el10_2.1 |
| rapidfort alma 9 | flatpak | 1.12.9-4.el9_8.1 |
| rapidfort alma 9 | flatpak-libs | 1.12.9-4.el9_8.1 |
| rapidfort alma 9 | flatpak-selinux | 1.12.9-4.el9_8.1 |
| rapidfort alma 9 | flatpak-session-helper | 1.12.9-4.el9_8.1 |
| rapidfort alpine 3.20 | flatpak | 1.16.4-r0 |
| rapidfort alpine 3.21 | flatpak | 1.16.4-r0 |
| rapidfort alpine 3.22 | flatpak | 1.16.4-r0 |
| rapidfort amazon linux 2023 | flatpak | 1.16.6-1.amzn2023 |
| rapidfort amazon linux 2023 | flatpak-devel | 1.16.6-1.amzn2023 |
| rapidfort amazon linux 2023 | flatpak-libs | 1.16.6-1.amzn2023 |
| rapidfort amazon linux 2023 | flatpak-selinux | 1.16.6-1.amzn2023 |
| rapidfort amazon linux 2023 | flatpak-session-helper | 1.16.6-1.amzn2023 |
| rapidfort amazon linux 2023 | flatpak-tests | 1.16.6-1.amzn2023 |
| rapidfort debian 12 | flatpak | 0:1.16.4-1, 0:1.16.6-1~deb13u1 |
| rapidfort debian 13 | flatpak | 0:1.16.4-1, 0:1.16.6-1~deb13u1 |
| rapidfort fedora 43 | flatpak | 1.16.4-1.fc43 |
| rapidfort fedora 43 | flatpak-devel | 1.16.4-1.fc43 |
| rapidfort fedora 43 | flatpak-libs | 1.16.4-1.fc43 |
| rapidfort fedora 43 | flatpak-selinux | 1.16.4-1.fc43 |
| rapidfort fedora 43 | flatpak-session-helper | 1.16.4-1.fc43 |
| rapidfort fedora 43 | flatpak-tests | 1.16.4-1.fc43 |
| rapidfort Oracle Linux 10 | flatpak | 0:1.16.0-9.el10_2.1 |
| rapidfort Oracle Linux 10 | flatpak-devel | 0:1.16.0-9.el10_2.1 |
| rapidfort Oracle Linux 10 | flatpak-libs | 0:1.16.0-9.el10_2.1 |
| rapidfort Oracle Linux 10 | flatpak-selinux | 0:1.16.0-9.el10_2.1 |
| rapidfort Oracle Linux 10 | flatpak-session-helper | 0:1.16.0-9.el10_2.1 |
| rapidfort Oracle Linux 9 | flatpak | 0:1.12.9-4.el9_8.1 |
| rapidfort Oracle Linux 9 | flatpak-devel | 0:1.12.9-4.el9_8.1 |
| rapidfort Oracle Linux 9 | flatpak-libs | 0:1.12.9-4.el9_8.1 |
| rapidfort Oracle Linux 9 | flatpak-selinux | 0:1.12.9-4.el9_8.1 |
| rapidfort Oracle Linux 9 | flatpak-session-helper | 0:1.12.9-4.el9_8.1 |
| rapidfort rocky 9 | flatpak | 0:1.12.9-4.el9_8.1 |
| rapidfort rocky 9 | flatpak-libs | 0:1.12.9-4.el9_8.1 |
| rapidfort rocky 9 | flatpak-session-helper | 0:1.12.9-4.el9_8.1 |
| rapidfort ubuntu 20.04 | flatpak | 0:1.16.4-1 |
| rapidfort ubuntu 22.04 | flatpak | 0:1.16.4-1 |
| rapidfort ubuntu 24.04 | flatpak | 0:1.16.4-1 |
| rocky 10 | flatpak | 1.16.0-9.el10_2.1 |
| rocky 10 | flatpak-libs | 1.16.0-9.el10_2.1 |
| rocky 10 | flatpak-selinux | 1.16.0-9.el10_2.1 |
| rocky 10 | flatpak-session-helper | 1.16.0-9.el10_2.1 |
| rocky 8 | flatpak | 1.12.9-4.el8_10 |
| rocky 8 | flatpak-libs | 1.12.9-4.el8_10 |
| rocky 8 | flatpak-selinux | 1.12.9-4.el8_10 |
| rocky 8 | flatpak-session-helper | 1.12.9-4.el8_10 |
| rocky 9 | flatpak | 1.12.9-4.el9_8.1 |
| rocky 9 | flatpak-libs | 1.12.9-4.el9_8.1 |
| rocky 9 | flatpak-selinux | 1.12.9-4.el9_8.1 |
| rocky 9 | flatpak-session-helper | 1.12.9-4.el9_8.1 |
| ubuntu 20.04-ESM | flatpak | 1.6.5-0ubuntu0.5+esm1 |
| ubuntu 22.04 | flatpak | sin corrección indicada |
| ubuntu 24.04 | flatpak | sin corrección indicada |
Referencias
- http://www.openwall.com/lists/oss-security/2026/04/09/8
- http://www.openwall.com/lists/oss-security/2026/04/10/14
- https://access.redhat.com/errata/RHSA-2026:21755
- https://access.redhat.com/errata/RHSA-2026:21756
- https://access.redhat.com/errata/RHSA-2026:21757
- https://access.redhat.com/errata/RHSA-2026:23417
- https://access.redhat.com/errata/RHSA-2026:23418
- https://access.redhat.com/errata/RHSA-2026:23419
Las 30 referencias
- https://access.redhat.com/errata/RHSA-2026:23420
- https://access.redhat.com/errata/RHSA-2026:25068
- https://access.redhat.com/errata/RHSA-2026:25381
- https://access.redhat.com/errata/RHSA-2026:30901
- https://access.redhat.com/errata/RHSA-2026:35843
- https://access.redhat.com/security/cve/CVE-2026-34078
- https://bugzilla.redhat.com/2456276
- https://bugzilla.redhat.com/2456284
- https://bugzilla.redhat.com/show_bug.cgi?id=2456276
- https://bugzilla.redhat.com/show_bug.cgi?id=2456284
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34078
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34079
- https://errata.almalinux.org/9/ALSA-2026-21755.html
- https://errata.rockylinux.org/RLSA-2026:21755
- https://github.com/flatpak/flatpak/security/advisories/GHSA-cc2q-qc34-jprg
- https://linux.oracle.com/cve/CVE-2026-34078.html
- https://linux.oracle.com/errata/ELSA-2026-35843.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-34078
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34078.json
- https://ubuntu.com/security/notices/USN-8741-1
- https://www.cve.org/CVERecord?id=CVE-2026-34078