Critical Security Update for Flatpak: Addressing Multiple Vulnerabilities
Summary
RHSA-2026:80687: Red Hat Security Advisory: flatpak security update. Affects flatpak versions < 0:1.12.9-7.el8_10. Fixed in 0:1.12.9-7.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flatpak is a software utility for software deployment, application virtualization, and package management. It allows developers to build and distribute applications in a sandboxed environment, ensuring that they run consistently across different Linux distributions. The recent vulnerabilities identified in Flatpak could potentially compromise the integrity and security of applications deployed using this technology.
Vulnerability Detail
The vulnerabilities identified in Flatpak, including CVE-2026-90616, CVE-2026-96275, CVE-2026-96280, and CVE-2026-96808, stem from flaws that could allow unauthorized access to sensitive data or execution of arbitrary code. These vulnerabilities can lead to significant security risks, including data breaches and system compromise. The CVSS score for this vulnerability is 8.8, indicating a high severity level that necessitates immediate attention.
How To Fix
Minimum fixed version
0:1.12.9-7.el8_10
This is the first release that contains the fix.
sudo dnf update flatpakTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the use of Flatpak applications until the update is applied. Additionally, consider using alternative package management systems that do not exhibit these vulnerabilities.
Conclusion
The identified vulnerabilities in Flatpak pose significant security risks that require immediate action. Users are strongly advised to update their Flatpak installations to the latest patched version to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for flatpak →
FAQ
The main vulnerabilities include CVE-2026-90616, CVE-2026-96275, CVE-2026-96280, and CVE-2026-96808, which could lead to unauthorized access and execution of arbitrary code.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
The CVSS score for this vulnerability is 8.8, indicating a high severity level.
If you cannot update immediately, consider limiting the use of Flatpak applications and monitoring for any unusual activity on your system.
More information can be found in the Red Hat Security Advisory and on the official CVE database.
Related vulnerabilities
Recent vulnerabilities recorded for flatpak.
