critical
CVE-2026-34078
flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Red Hat9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Red Hat (high), AlmaLinux (high), Amazon (high), Oracle (high), Rocky Linux (high), Ubuntu (medium).
Description
Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in 1.16.4.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| alma 10 | flatpak, flatpak-devel, flatpak-libs and 2 more | 1.16.0-9.el10_2.1 |
| alma 8 | flatpak, flatpak-devel, flatpak-libs and 2 more | 1.12.9-4.el8_10 |
| alma 9 | flatpak, flatpak-devel, flatpak-libs and 2 more | 1.12.9-4.el9_8.1 |
| alpine 3.23 | flatpak | 1.16.4-r0 |
| alpine 3.24 | flatpak | 1.16.4-r0 |
| alpine edge | flatpak | 1.16.4-r0 |
| amazon linux 2 | flatpak, flatpak-builder, flatpak-debuginfo and 2 more | 1.0.9-10.amzn2.0.7 and 1 more |
| amazon linux 2023 | flatpak, flatpak-debuginfo, flatpak-debugsource and 8 more | 1.16.6-1.amzn2023 |
| debian 11 | flatpak | no fix listed |
| debian 12 | flatpak | 1.14.10-1~deb12u2 |
| debian 13 | flatpak | 1.16.6-1~deb13u1 |
| debian 14 | flatpak | 1.16.4-1 |
Show all 110 entries from 37 sources
| Source | Package | Fixed in |
|---|---|---|
| alma 10 | flatpak | 1.16.0-9.el10_2.1 |
| alma 10 | flatpak-devel | 1.16.0-9.el10_2.1 |
| alma 10 | flatpak-libs | 1.16.0-9.el10_2.1 |
| alma 10 | flatpak-selinux | 1.16.0-9.el10_2.1 |
| alma 10 | flatpak-session-helper | 1.16.0-9.el10_2.1 |
| alma 8 | flatpak | 1.12.9-4.el8_10 |
| alma 8 | flatpak-devel | 1.12.9-4.el8_10 |
| alma 8 | flatpak-libs | 1.12.9-4.el8_10 |
| alma 8 | flatpak-selinux | 1.12.9-4.el8_10 |
| alma 8 | flatpak-session-helper | 1.12.9-4.el8_10 |
| alma 9 | flatpak | 1.12.9-4.el9_8.1 |
| alma 9 | flatpak-devel | 1.12.9-4.el9_8.1 |
| alma 9 | flatpak-libs | 1.12.9-4.el9_8.1 |
| alma 9 | flatpak-selinux | 1.12.9-4.el9_8.1 |
| alma 9 | flatpak-session-helper | 1.12.9-4.el9_8.1 |
| alpine 3.23 | flatpak | 1.16.4-r0 |
| alpine 3.24 | flatpak | 1.16.4-r0 |
| alpine edge | flatpak | 1.16.4-r0 |
| amazon linux 2 | flatpak | 1.0.9-10.amzn2.0.7 |
| amazon linux 2 | flatpak-builder | 1.0.0-10.amzn2.0.7 |
| amazon linux 2 | flatpak-debuginfo | 1.0.9-10.amzn2.0.7 |
| amazon linux 2 | flatpak-devel | 1.0.9-10.amzn2.0.7 |
| amazon linux 2 | flatpak-libs | 1.0.9-10.amzn2.0.7 |
| amazon linux 2023 | flatpak | 1.16.6-1.amzn2023 |
| amazon linux 2023 | flatpak-debuginfo | 1.16.6-1.amzn2023 |
| amazon linux 2023 | flatpak-debugsource | 1.16.6-1.amzn2023 |
| amazon linux 2023 | flatpak-devel | 1.16.6-1.amzn2023 |
| amazon linux 2023 | flatpak-libs | 1.16.6-1.amzn2023 |
| amazon linux 2023 | flatpak-libs-debuginfo | 1.16.6-1.amzn2023 |
| amazon linux 2023 | flatpak-selinux | 1.16.6-1.amzn2023 |
| amazon linux 2023 | flatpak-session-helper | 1.16.6-1.amzn2023 |
| amazon linux 2023 | flatpak-session-helper-debuginfo | 1.16.6-1.amzn2023 |
| amazon linux 2023 | flatpak-tests | 1.16.6-1.amzn2023 |
| amazon linux 2023 | flatpak-tests-debuginfo | 1.16.6-1.amzn2023 |
| debian 11 | flatpak | no fix listed |
| debian 12 | flatpak | 1.14.10-1~deb12u2 |
| debian 13 | flatpak | 1.16.6-1~deb13u1 |
| debian 14 | flatpak | 1.16.4-1 |
| echo | flatpak | 1.14.10-1~deb12u2 |
| Oracle Linux 7 | flatpak | 1.12.9-4.0.1.el7 |
| Oracle Linux 7 | flatpak-builder | 1.0.0-17.0.1.el7 |
| Oracle Linux 7 | flatpak-devel | 1.12.9-4.0.1.el7 |
| Oracle Linux 7 | flatpak-libs | 1.12.9-4.0.1.el7 |
| Oracle Linux 8 | flatpak | 1.12.9-4.el8_10 |
| Oracle Linux 8 | flatpak-devel | 1.12.9-4.el8_10 |
| Oracle Linux 8 | flatpak-libs | 1.12.9-4.el8_10 |
| Oracle Linux 8 | flatpak-selinux | 1.12.9-4.el8_10 |
| Oracle Linux 8 | flatpak-session-helper | 1.12.9-4.el8_10 |
| Oracle Linux 9 | flatpak | 1.12.9-4.el9_8.1 |
| Oracle Linux 9 | flatpak-devel | 1.12.9-4.el9_8.1 |
| Oracle Linux 9 | flatpak-libs | 1.12.9-4.el9_8.1 |
| Oracle Linux 9 | flatpak-selinux | 1.12.9-4.el9_8.1 |
| Oracle Linux 9 | flatpak-session-helper | 1.12.9-4.el9_8.1 |
| rapidfort alma 10 | flatpak | 1.16.0-9.el10_2.1 |
| rapidfort alma 10 | flatpak-devel | 1.16.0-9.el10_2.1 |
| rapidfort alma 10 | flatpak-libs | 1.16.0-9.el10_2.1 |
| rapidfort alma 10 | flatpak-selinux | 1.16.0-9.el10_2.1 |
| rapidfort alma 10 | flatpak-session-helper | 1.16.0-9.el10_2.1 |
| rapidfort alma 9 | flatpak | 1.12.9-4.el9_8.1 |
| rapidfort alma 9 | flatpak-libs | 1.12.9-4.el9_8.1 |
| rapidfort alma 9 | flatpak-selinux | 1.12.9-4.el9_8.1 |
| rapidfort alma 9 | flatpak-session-helper | 1.12.9-4.el9_8.1 |
| rapidfort alpine 3.20 | flatpak | 1.16.4-r0 |
| rapidfort alpine 3.21 | flatpak | 1.16.4-r0 |
| rapidfort alpine 3.22 | flatpak | 1.16.4-r0 |
| rapidfort amazon linux 2023 | flatpak | 1.16.6-1.amzn2023 |
| rapidfort amazon linux 2023 | flatpak-devel | 1.16.6-1.amzn2023 |
| rapidfort amazon linux 2023 | flatpak-libs | 1.16.6-1.amzn2023 |
| rapidfort amazon linux 2023 | flatpak-selinux | 1.16.6-1.amzn2023 |
| rapidfort amazon linux 2023 | flatpak-session-helper | 1.16.6-1.amzn2023 |
| rapidfort amazon linux 2023 | flatpak-tests | 1.16.6-1.amzn2023 |
| rapidfort debian 12 | flatpak | 0:1.16.4-1, 0:1.16.6-1~deb13u1 |
| rapidfort debian 13 | flatpak | 0:1.16.4-1, 0:1.16.6-1~deb13u1 |
| rapidfort fedora 43 | flatpak | 1.16.4-1.fc43 |
| rapidfort fedora 43 | flatpak-devel | 1.16.4-1.fc43 |
| rapidfort fedora 43 | flatpak-libs | 1.16.4-1.fc43 |
| rapidfort fedora 43 | flatpak-selinux | 1.16.4-1.fc43 |
| rapidfort fedora 43 | flatpak-session-helper | 1.16.4-1.fc43 |
| rapidfort fedora 43 | flatpak-tests | 1.16.4-1.fc43 |
| rapidfort Oracle Linux 10 | flatpak | 0:1.16.0-9.el10_2.1 |
| rapidfort Oracle Linux 10 | flatpak-devel | 0:1.16.0-9.el10_2.1 |
| rapidfort Oracle Linux 10 | flatpak-libs | 0:1.16.0-9.el10_2.1 |
| rapidfort Oracle Linux 10 | flatpak-selinux | 0:1.16.0-9.el10_2.1 |
| rapidfort Oracle Linux 10 | flatpak-session-helper | 0:1.16.0-9.el10_2.1 |
| rapidfort Oracle Linux 9 | flatpak | 0:1.12.9-4.el9_8.1 |
| rapidfort Oracle Linux 9 | flatpak-devel | 0:1.12.9-4.el9_8.1 |
| rapidfort Oracle Linux 9 | flatpak-libs | 0:1.12.9-4.el9_8.1 |
| rapidfort Oracle Linux 9 | flatpak-selinux | 0:1.12.9-4.el9_8.1 |
| rapidfort Oracle Linux 9 | flatpak-session-helper | 0:1.12.9-4.el9_8.1 |
| rapidfort rocky 9 | flatpak | 0:1.12.9-4.el9_8.1 |
| rapidfort rocky 9 | flatpak-libs | 0:1.12.9-4.el9_8.1 |
| rapidfort rocky 9 | flatpak-session-helper | 0:1.12.9-4.el9_8.1 |
| rapidfort ubuntu 20.04 | flatpak | 0:1.16.4-1 |
| rapidfort ubuntu 22.04 | flatpak | 0:1.16.4-1 |
| rapidfort ubuntu 24.04 | flatpak | 0:1.16.4-1 |
| rocky 10 | flatpak | 1.16.0-9.el10_2.1 |
| rocky 10 | flatpak-libs | 1.16.0-9.el10_2.1 |
| rocky 10 | flatpak-selinux | 1.16.0-9.el10_2.1 |
| rocky 10 | flatpak-session-helper | 1.16.0-9.el10_2.1 |
| rocky 8 | flatpak | 1.12.9-4.el8_10 |
| rocky 8 | flatpak-libs | 1.12.9-4.el8_10 |
| rocky 8 | flatpak-selinux | 1.12.9-4.el8_10 |
| rocky 8 | flatpak-session-helper | 1.12.9-4.el8_10 |
| rocky 9 | flatpak | 1.12.9-4.el9_8.1 |
| rocky 9 | flatpak-libs | 1.12.9-4.el9_8.1 |
| rocky 9 | flatpak-selinux | 1.12.9-4.el9_8.1 |
| rocky 9 | flatpak-session-helper | 1.12.9-4.el9_8.1 |
| ubuntu 20.04-ESM | flatpak | 1.6.5-0ubuntu0.5+esm1 |
| ubuntu 22.04 | flatpak | no fix listed |
| ubuntu 24.04 | flatpak | no fix listed |
References
- http://www.openwall.com/lists/oss-security/2026/04/09/8
- http://www.openwall.com/lists/oss-security/2026/04/10/14
- https://access.redhat.com/errata/RHSA-2026:21755
- https://access.redhat.com/errata/RHSA-2026:21756
- https://access.redhat.com/errata/RHSA-2026:21757
- https://access.redhat.com/errata/RHSA-2026:23417
- https://access.redhat.com/errata/RHSA-2026:23418
- https://access.redhat.com/errata/RHSA-2026:23419
All 30 references
- https://access.redhat.com/errata/RHSA-2026:23420
- https://access.redhat.com/errata/RHSA-2026:25068
- https://access.redhat.com/errata/RHSA-2026:25381
- https://access.redhat.com/errata/RHSA-2026:30901
- https://access.redhat.com/errata/RHSA-2026:35843
- https://access.redhat.com/security/cve/CVE-2026-34078
- https://bugzilla.redhat.com/2456276
- https://bugzilla.redhat.com/2456284
- https://bugzilla.redhat.com/show_bug.cgi?id=2456276
- https://bugzilla.redhat.com/show_bug.cgi?id=2456284
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34078
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34079
- https://errata.almalinux.org/9/ALSA-2026-21755.html
- https://errata.rockylinux.org/RLSA-2026:21755
- https://github.com/flatpak/flatpak/security/advisories/GHSA-cc2q-qc34-jprg
- https://linux.oracle.com/cve/CVE-2026-34078.html
- https://linux.oracle.com/errata/ELSA-2026-35843.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-34078
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34078.json
- https://ubuntu.com/security/notices/USN-8741-1
- https://www.cve.org/CVERecord?id=CVE-2026-34078