Critical Security Update for Flatpak: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:80498: Important: flatpak security update. Affects flatpak versions < 1.16.0-9.el10_2.4. Fixed in 1.16.0-9.el10_2.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flatpak is a powerful system designed for building, distributing, and running sandboxed desktop applications on Linux. It allows developers to package their applications with all necessary dependencies, ensuring they run consistently across different Linux distributions. However, recent vulnerabilities have been identified that could compromise the security of applications using Flatpak, making it crucial for users to stay informed and update their systems.
Vulnerability Detail
The vulnerabilities in Flatpak include arbitrary code execution due to missing symlink protection (CVE-2026-90616), arbitrary write access as root via extra-data extraction (CVE-2026-96275), a buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280), and local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808). These issues can lead to severe security breaches, allowing malicious actors to execute unauthorized code, gain elevated privileges, or manipulate system files.
How To Fix
Minimum fixed version
1.16.0-9.el10_2.4
This is the first release that contains the fix.
sudo dnf update flatpakTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the permissions of Flatpak applications or avoid using Flatpak for sensitive applications until the update is applied. Additionally, users should regularly check for updates and security advisories related to Flatpak.
Conclusion
The recent vulnerabilities in Flatpak pose significant security risks that can lead to unauthorized access and code execution. It is essential for users to update their Flatpak installations to the latest patched version to safeguard their systems. Regular monitoring and adherence to security advisories will help maintain a secure environment.
See every vulnerability recorded for flatpak →
FAQ
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux, ensuring consistent operation across various distributions.
The vulnerabilities include arbitrary code execution, arbitrary write access as root, buffer overflow, and local privilege escalation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
As a workaround, limit the permissions of Flatpak applications or avoid using them for sensitive tasks until the vulnerabilities are patched.
For detailed information, refer to the CVE pages listed in the advisory or check the official Flatpak documentation.
Related vulnerabilities
Recent vulnerabilities recorded for flatpak.
