Critical Security Vulnerability in Flatpak: Update Required
Summary
RHSA-2026:80497: Red Hat Security Advisory: flatpak security update. Affects flatpak versions < 0:1.12.9-4.el9_8.4. Fixed in 0:1.12.9-4.el9_8.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flatpak is a software utility for software deployment, application virtualization, and package management. It allows developers to create and distribute applications in a sandboxed environment, ensuring that applications run consistently across different Linux distributions. The recent vulnerabilities identified in Flatpak could potentially allow unauthorized access and manipulation of applications, posing significant security risks to users and systems.
Vulnerability Detail
The vulnerabilities identified in Flatpak, including CVE-2026-90616, CVE-2026-96275, CVE-2026-96280, and CVE-2026-96808, stem from flaws in the package management system that could allow attackers to exploit the sandboxing features. These vulnerabilities could lead to unauthorized access to sensitive data, application crashes, or even system compromise. The CVSS score of this vulnerability is 8.8, indicating a high severity level that necessitates immediate attention.
How To Fix
Minimum fixed version
0:1.12.9-4.el9_8.4
This is the first release that contains the fix.
sudo dnf update flatpakTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the permissions of Flatpak applications or avoid using Flatpak until the updates are applied. This can be done by adjusting the sandbox settings or using alternative package management systems.
Conclusion
The identified vulnerabilities in Flatpak pose significant security risks that require immediate attention. Users are urged to update their Flatpak installations to the latest patched version to mitigate these risks. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for flatpak →
FAQ
Flatpak is a software utility that allows developers to package applications in a way that they can run on any Linux distribution without modification.
The vulnerabilities could allow unauthorized access to sensitive data, application crashes, or system compromise, leading to potential data breaches.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
If an immediate update is not possible, consider limiting the permissions of Flatpak applications or using alternative package management systems as a temporary measure.
Detailed information can be found in the Red Hat Security Advisory and the CVE entries associated with the vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for flatpak.
