CVE-2026-86320
Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)
A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)
A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.
- Record
CVE-2026-86320- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-03
EUVDEUVD-2026-81387
A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.
- Record
EUVD-2026-81387- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rvpr-5p35-6vf8
A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources...
A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.
- Record
GHSA-rvpr-5p35-6vf8- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
NVD
A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.
- Record
CVE-2026-86320- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-86320
A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.
- Record
ALPINE-CVE-2026-86320- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVDEBIAN-CVE-2026-86320
A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.
- Record
DEBIAN-CVE-2026-86320- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 21 moreShow less
OSVOESA-2026-4074
flatpak-builder security update
Flatpak-builder is a tool for building flatpaks from sources.
Security Fix(es):
A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.(CVE-2026-86320)
- Record
OESA-2026-4074- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-4224
flatpak-builder security update
Flatpak-builder is a tool for building flatpaks from sources.
Security Fix(es):
A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.(CVE-2026-86320)
- Record
OESA-2026-4224- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-4225
flatpak-builder security update
Flatpak-builder is a tool for building flatpaks from sources.
Security Fix(es):
A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.(CVE-2026-86320)
- Record
OESA-2026-4225- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-4226
flatpak-builder security update
Flatpak-builder is a tool for building flatpaks from sources.
Security Fix(es):
A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.(CVE-2026-86320)
- Record
OESA-2026-4226- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:80495
Red Hat Security Advisory: flatpak-builder security update
- Record
RHSA-2026:80495- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:80496
Red Hat Security Advisory: flatpak-builder security update
- Record
RHSA-2026:80496- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:80973
Red Hat Security Advisory: flatpak-builder security update
- Record
RHSA-2026:80973- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:84832
Red Hat Security Advisory: flatpak-builder security update
- Record
RHSA-2026:84832- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:84833
Red Hat Security Advisory: flatpak-builder security update
- Record
RHSA-2026:84833- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:84834
Red Hat Security Advisory: flatpak-builder security update
- Record
RHSA-2026:84834- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:84842
Red Hat Security Advisory: flatpak-builder security update
- Record
RHSA-2026:84842- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:80495
Important: flatpak-builder security update
Flatpak-builder is a tool for building flatpaks from sources.
Security Fix(es):
- flatpak-builder: Host code execution via
git amhook execution in patch source extraction (use-git-am) (CVE-2026-86320)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:80495- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:80496
Important: flatpak-builder security update
Flatpak-builder is a tool for building flatpaks from sources.
Security Fix(es):
- flatpak-builder: Host code execution via
git amhook execution in patch source extraction (use-git-am) (CVE-2026-86320)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:80496- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:80973
Important: flatpak-builder security update
Flatpak-builder is a tool for building flatpaks from sources.
Security Fix(es):
- flatpak-builder: Host code execution via
git amhook execution in patch source extraction (use-git-am) (CVE-2026-86320)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:80973- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-86320
A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.
- Record
UBUNTU-CVE-2026-86320- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVALSA-2026:80495 No score
Important: flatpak-builder security update
Flatpak-builder is a tool for building flatpaks from sources.
Security Fix(es):
- flatpak-builder: Host code execution via
git amhook execution in patch source extraction (use-git-am) (CVE-2026-86320)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:80495- Updated
- 2026-11-02
OSVALSA-2026:80496 No score
Important: flatpak-builder security update
Flatpak-builder is a tool for building flatpaks from sources.
Security Fix(es):
- flatpak-builder: Host code execution via
git amhook execution in patch source extraction (use-git-am) (CVE-2026-86320)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:80496- Updated
- 2026-11-02
OSVALSA-2026:80973 No score
Important: flatpak-builder security update
Flatpak-builder is a tool for building flatpaks from sources.
Security Fix(es):
- flatpak-builder: Host code execution via
git amhook execution in patch source extraction (use-git-am) (CVE-2026-86320)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:80973- Updated
- 2026-11-02
OSVCLSA-2026-1792771054 No score
flatpak-builder: Fix of CVE-2026-86320
- CVE-2026-86320: disable git hooks when applying patch sources
- Record
CLSA-2026-1792771054- Updated
- 2026-11-02
OSVMGASA-2026-0519 No score
Updated flatpak-builder package fixes a security vulnerability
Host code execution via git am hook execution in patch source
extraction (use-git-am). (CVE-2026-86320)
- Record
MGASA-2026-0519- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11845-1 No score
flatpak-builder-1.4.12-1.1 on GA media
These are all security issues fixed in the flatpak-builder-1.4.12-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11845-1- Updated
- 2026-11-02
Affected products
- red hat enterprise linux 10
- red hat enterprise linux 10.0 extended update support
- red hat enterprise linux 8
- red hat enterprise linux 8.4 advanced mission critical update support
- red hat enterprise linux 8.4 extended update support long-life add-on
- red hat enterprise linux 8.6 advanced mission critical update support
- red hat enterprise linux 8.6 extended update support long-life add-on
- red hat enterprise linux 8.8 telecommunications update service
- red hat enterprise linux 8.8 update services for sap solutions
- red hat enterprise linux 9
- red hat enterprise linux 9.2 update services for sap solutions
- red hat enterprise linux 9.4 update services for sap solutions
Show 1 moreShow less
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flatpak-builderAlpine:v3.24 |
before 1.4.11-r0 | 1.4.11-r0 |
flatpak-builderAlmaLinux:10 |
before 1.4.4-1.el10_2.1 | 1.4.4-1.el10_2.1 |
flatpak-builderAlmaLinux:9 |
before 1.2.3-1.el9_8.1 | 1.2.3-1.el9_8.1 |
flatpak-builderAlmaLinux:8 |
before 1.2.3-2.el8_10 | 1.2.3-2.el8_10 |
flatpak-builderTuxCare:AlmaLinux:9.6 |
before 1.2.3-1.el9_6.tuxcare.els1 | 1.2.3-1.el9_6.tuxcare.els1 |
flatpak-builderDebian:12 |
All versions, plus listed versions 1.2.3-11.3.1-11.3.3-11.3.4-11.3.5-1 Show 16 moreShow less1.4.0-11.4.1-11.4.10-11.4.11-11.4.12-11.4.12-21.4.2-11.4.4-11.4.4-1~bpo12+11.4.4-21.4.5-11.4.6-11.4.6-21.4.7-11.4.8-11.4.9-1 |
None known |
flatpak-builderDebian:13 |
All versions, plus listed versions 1.4.10-11.4.11-11.4.12-11.4.12-21.4.4-2 Show 6 moreShow less1.4.5-11.4.6-11.4.6-21.4.7-11.4.8-11.4.9-1 |
None known |
flatpak-builderDebian:14 |
before 1.4.11-1, plus listed versions 1.4.10-11.4.4-21.4.5-11.4.6-11.4.6-21.4.7-11.4.8-11.4.9-1 |
1.4.11-1 |
flatpak-builderMageia:10 |
before 1.4.12-1.mga10 | 1.4.12-1.mga10 |
flatpak-builderopenEuler:22.03-LTS-SP4 |
before 1.0.14-3.oe2203sp4 | 1.0.14-3.oe2203sp4 |
Show 34 moreShow less
| Package | Affected | Fixed |
|---|---|---|
flatpak-builderopenEuler:24.03-LTS-SP4 |
before 1.3.5-3.oe2403sp4 | 1.3.5-3.oe2403sp4 |
flatpak-builderopenEuler:24.03-LTS-SP1 |
before 1.3.5-3.oe2403sp1 | 1.3.5-3.oe2403sp1 |
flatpak-builderopenEuler:24.03-LTS-SP3 |
before 1.3.5-3.oe2403sp3 | 1.3.5-3.oe2403sp3 |
flatpak-builderRed Hat:enterprise_linux:10.2 |
before 0:1.4.4-1.el10_2.1 | 0:1.4.4-1.el10_2.1 |
flatpak-builder-debuginfoRed Hat:enterprise_linux:10.2 |
before 0:1.4.4-1.el10_2.1 | 0:1.4.4-1.el10_2.1 |
flatpak-builder-debugsourceRed Hat:enterprise_linux:10.2 |
before 0:1.4.4-1.el10_2.1 | 0:1.4.4-1.el10_2.1 |
flatpak-builderRed Hat:enterprise_linux:9::appstream |
before 0:1.2.3-1.el9_8.1 | 0:1.2.3-1.el9_8.1 |
flatpak-builder-debuginfoRed Hat:enterprise_linux:9::appstream |
before 0:1.2.3-1.el9_8.1 | 0:1.2.3-1.el9_8.1 |
flatpak-builder-debugsourceRed Hat:enterprise_linux:9::appstream |
before 0:1.2.3-1.el9_8.1 | 0:1.2.3-1.el9_8.1 |
flatpak-builderRed Hat:enterprise_linux:8::appstream |
before 0:1.2.3-2.el8_10 | 0:1.2.3-2.el8_10 |
flatpak-builder-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:1.2.3-2.el8_10 | 0:1.2.3-2.el8_10 |
flatpak-builder-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:1.2.3-2.el8_10 | 0:1.2.3-2.el8_10 |
flatpak-builderRed Hat:rhel_e4s:9.4::appstream |
before 0:1.2.3-2.el9_4 | 0:1.2.3-2.el9_4 |
flatpak-builder-debuginfoRed Hat:rhel_e4s:9.4::appstream |
before 0:1.2.3-2.el9_4 | 0:1.2.3-2.el9_4 |
flatpak-builder-debugsourceRed Hat:rhel_e4s:9.4::appstream |
before 0:1.2.3-2.el9_4 | 0:1.2.3-2.el9_4 |
flatpak-builderRed Hat:rhel_eus:9.6::appstream |
before 0:1.2.3-1.el9_6.1 | 0:1.2.3-1.el9_6.1 |
flatpak-builder-debuginfoRed Hat:rhel_eus:9.6::appstream |
before 0:1.2.3-1.el9_6.1 | 0:1.2.3-1.el9_6.1 |
flatpak-builder-debugsourceRed Hat:rhel_eus:9.6::appstream |
before 0:1.2.3-1.el9_6.1 | 0:1.2.3-1.el9_6.1 |
flatpak-builderRed Hat:enterprise_linux_eus:10.0 |
before 0:1.4.4-1.el10_0.1 | 0:1.4.4-1.el10_0.1 |
flatpak-builder-debuginfoRed Hat:enterprise_linux_eus:10.0 |
before 0:1.4.4-1.el10_0.1 | 0:1.4.4-1.el10_0.1 |
flatpak-builder-debugsourceRed Hat:enterprise_linux_eus:10.0 |
before 0:1.4.4-1.el10_0.1 | 0:1.4.4-1.el10_0.1 |
flatpak-builderRed Hat:rhel_e4s:9.2::appstream |
before 0:1.2.2-2.el9_2 | 0:1.2.2-2.el9_2 |
flatpak-builder-debuginfoRed Hat:rhel_e4s:9.2::appstream |
before 0:1.2.2-2.el9_2 | 0:1.2.2-2.el9_2 |
flatpak-builder-debugsourceRed Hat:rhel_e4s:9.2::appstream |
before 0:1.2.2-2.el9_2 | 0:1.2.2-2.el9_2 |
flatpak-builderRocky Linux:10 |
before 0:1.4.4-1.el10_2.1 | 0:1.4.4-1.el10_2.1 |
flatpak-builderRocky Linux:9 |
before 0:1.2.3-1.el9_8.1 | 0:1.2.3-1.el9_8.1 |
flatpak-builderRocky Linux:8 |
before 0:1.2.3-2.el8_10 | 0:1.2.3-2.el8_10 |
flatpak-builderUbuntu:18.04:LTS |
All versions, plus listed versions 0.10.1-10.10.4-10.10.5-10.10.6-10.10.6-2 Show 4 moreShow less0.10.7-10.10.8-10.10.9-10.10.9-1ubuntu1 |
None known |
flatpak-builderUbuntu:20.04:LTS |
All versions, plus listed versions 1.0.8-21.0.9-11.0.10-1 |
None known |
flatpak-builderUbuntu:22.04:LTS |
All versions, plus listed versions 1.0.14-21.2.0-11.2.1-11.2.2-11.2.2-2 |
None known |
flatpak-builderUbuntu:24.04:LTS |
All versions, plus listed versions 1.2.3-11.4.0-11.4.1-11.4.2-1build11.4.2-1build2 |
None known |
flatpak-builderUbuntu:26.10 |
All versions, plus listed versions 1.4.8-11.4.9-11.4.10-11.4.11-11.4.12-1 |
None known |
flatpak-builderUbuntu:26.04:LTS |
All versions, plus listed versions 1.4.6-21.4.7-11.4.8-1 |
None known |
flatpak-builderopenSUSE:Tumbleweed |
before 1.4.12-1.1 | 1.4.12-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | CVE List, EUVD, OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-86320 is a high vulnerability (CVSS 7.8) in Red Hat Enterprise Linux 10, published September 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. Fixed in flatpak-builder 1.4.11-r0.
References
access.redhat.com/errata/RHSA-2026:80495
Show 38 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2471023
github.com/flatpak/flatpak-builder/security/advisories/GHSA-j5p8-jgjc-f3xv
nvd.nist.gov/vuln/detail/CVE-2026-86320
security.alpinelinux.org/vuln/CVE-2026-86320
errata.almalinux.org/10/ALSA-2026-80495.html
errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1792771054.html
security-tracker.debian.org/tracker/CVE-2026-86320
advisories.mageia.org/MGASA-2026-0519.html
bugs.mageia.org/show_bug.cgi?id=36407
lists.opensuse.org/archives/list/[email protected]/message/BJF2ORPRVKVTXPAFIDS6U5SNJHW6VTMX
lists.fedoraproject.org/archives/list/[email protected]/message/NJHPETQUQKC4Z7Z3LWM37VPXNFDJHFGB
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-4074
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80495.json
cve.org/CVERecord?id=CVE-2026-86320
errata.rockylinux.org/RLSA-2026:80495
ubuntu.com/security/CVE-2026-86320
suse.com/security/cve/CVE-2026-86320