Critical Security Flaw in Flatpak: Arbitrary Code Execution and Privilege Escalation
Summary
ALSA-2026:80687: Important: flatpak security update. Affects flatpak versions < 1.12.9-7.el8_10. Fixed in 1.12.9-7.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flatpak is a robust system designed for building, distributing, and running sandboxed desktop applications on Linux. It allows developers to package their applications with all necessary dependencies, ensuring consistent behavior across different Linux distributions. However, recent vulnerabilities have exposed Flatpak to significant security risks, including arbitrary code execution and local privilege escalation, which could compromise system integrity.
Vulnerability Detail
The vulnerabilities in Flatpak stem from several critical issues: missing symlink protection allows for arbitrary code execution (CVE-2026-90616), while improper handling of extra-data extraction can lead to arbitrary write access as root (CVE-2026-96275). Additionally, a buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280) and local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808) further exacerbate the risks. These vulnerabilities can allow attackers to execute malicious code, gain unauthorized access, or escalate privileges, posing severe threats to system security.
How To Fix
Minimum fixed version
1.12.9-7.el8_10
This is the first release that contains the fix.
sudo dnf update flatpakTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict the execution of Flatpak applications or limit their permissions until the update is applied. This can be done by modifying the Flatpak configuration to disable certain features or by running applications in a more restricted environment.
Conclusion
The identified vulnerabilities in Flatpak pose significant risks, including arbitrary code execution and local privilege escalation. It is crucial for users to update their packages to the latest patched version to safeguard their systems. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for flatpak →
FAQ
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux, ensuring consistent behavior across different distributions.
The main vulnerabilities include arbitrary code execution, arbitrary write access as root, buffer overflow on 32-bit systems, and local privilege escalation.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected without needing to sign up.
As a workaround, consider restricting the execution of Flatpak applications or running them in a more controlled environment until you can apply the update.
For detailed information, refer to the CVE pages linked in the advisory or consult the Flatpak documentation for security best practices.
Related vulnerabilities
Recent vulnerabilities recorded for flatpak.
