Every CVE Search/ Get API key

CVE-2026-90616

In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to...

7.4 HighFix available

In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak creates a few app data directories (e.g., /var/cache, /var/data, /var/config, and /var/tmp) in every sandbox on every app launch where, in some cases, components of the path are attacker-controlled. Missing symlink protection can redirect the directories. Some of these directories are bind-mounted by Flatpak by passing the path (e.g., /home/user/.var/app/APP_ID/cache/tmp), which contains attacker-controlled directories (tmp) to bwrap --bind SRC DST. bwrap passes the path on to the kernel, which then follows symlinks. A malicious symlink can point to arbitrary locations on the host and it will become mounted inside the sandbox.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.18%Unchanged since Sep 14, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.4

In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak creates a few app data directories (e.g., /var/cache, /var/data, /var/config, and /var/tmp) in every sandbox on every app launch where, in some cases, components of the path are attacker-controlled. Missing symlink protection can redirect the directories. Some of these directories are bind-mounted by Flatpak by passing the path (e.g., /home/user/.var/app/APP_ID/cache/tmp), which contains attacker-controlled directories (tmp) to bwrap --bind SRC DST. bwrap passes the path on to the kernel, which then follows symlinks. A malicious symlink can point to arbitrary locations on the host and it will become mounted inside the sandbox.

Record
CVE-2026-90616
CVSS 3.1
7.4 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-61
Updated
2026-11-02
EUVDEUVD-2026-76911 7.4

In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak creates a few app data directories (e.g., /var/cache, /var/data, /var/config, and /var/tmp) in every sandbox on every app launch where, in some cases, components of the path are attacker-controlled. Missing symlink protection can redirect the directories. Some of these directories are bind-mounted by Flatpak by passing the path (e.g., /home/user/.var/app/APP_ID/cache/tmp), which contains attacker-controlled directories (tmp) to bwrap --bind SRC DST. bwrap passes the path on to the kernel, which then follows symlinks. A malicious symlink can point to arbitrary locations on the host and it will become mounted inside the sandbox.

Record
EUVD-2026-76911
CVSS 3.1
7.4 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-vhx5-8pfj-7wrv 7.4

In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to...

In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak creates a few app data directories (e.g., /var/cache, /var/data, /var/config, and /var/tmp) in every sandbox on every app launch where, in some cases, components of the path are attacker-controlled. Missing symlink protection can redirect the directories. Some of these directories are bind-mounted by Flatpak by passing the path (e.g., /home/user/.var/app/APP_ID/cache/tmp), which contains attacker-controlled directories (tmp) to bwrap --bind SRC DST. bwrap passes the path on to the kernel, which then follows symlinks. A malicious symlink can point to arbitrary locations on the host and it will become mounted inside the sandbox.

Record
GHSA-vhx5-8pfj-7wrv
CVSS 3.1
7.4 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-61
Updated
2026-11-02
NVD 7.4

In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak creates a few app data directories (e.g., /var/cache, /var/data, /var/config, and /var/tmp) in every sandbox on every app launch where, in some cases, components of the path are attacker-controlled. Missing symlink protection can redirect the directories. Some of these directories are bind-mounted by Flatpak by passing the path (e.g., /home/user/.var/app/APP_ID/cache/tmp), which contains attacker-controlled directories (tmp) to bwrap --bind SRC DST. bwrap passes the path on to the kernel, which then follows symlinks. A malicious symlink can point to arbitrary locations on the host and it will become mounted inside the sandbox.

Record
CVE-2026-90616
CVSS 3.1
7.4 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-61
Updated
2026-11-02
OSV 7.4

In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak creates a few app data directories (e.g., /var/cache, /var/data, /var/config, and /var/tmp) in every sandbox on every app launch where, in some cases, components of the path are attacker-controlled. Missing symlink protection can redirect the directories. Some of these directories are bind-mounted by Flatpak by passing the path (e.g., /home/user/.var/app/APP_ID/cache/tmp), which contains attacker-controlled directories (tmp) to bwrap --bind SRC DST. bwrap passes the path on to the kernel, which then follows symlinks. A malicious symlink can point to arbitrary locations on the host and it will become mounted inside the sandbox.

Record
CVE-2026-90616
CVSS 3.1
7.4 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-61
Updated
2026-11-07
OSVDEBIAN-CVE-2026-90616 7.4

In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak creates a few app data directories (e.g., /var/cache, /var/data, /var/config, and /var/tmp) in every sandbox on every app launch where, in some cases, components of the path are attacker-controlled. Missing symlink protection can redirect the directories. Some of these directories are bind-mounted by Flatpak by passing the path (e.g., /home/user/.var/app/APP_ID/cache/tmp), which contains attacker-controlled directories (tmp) to bwrap --bind SRC DST. bwrap passes the path on to the kernel, which then follows symlinks. A malicious symlink can point to arbitrary locations on the host and it will become mounted inside the sandbox.

Record
DEBIAN-CVE-2026-90616
CVSS 3.1
7.4 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 18 moreShow less
OSVOESA-2026-4098 7.4

flatpak security update

flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.

Security Fix(es):

In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak creates a few app data directories (e.g., /var/cache, /var/data, /var/config, and /var/tmp) in every sandbox on every app launch where, in some cases, components of the path are attacker-controlled. Missing symlink protection can redirect the directories. Some of these directories are bind-mounted by Flatpak by passing the path (e.g., /home/user/.var/app/APP_ID/cache/tmp), which contains attacker-controlled directories (tmp) to bwrap --bind SRC DST. bwrap passes the path on to the kernel, which then follows symlinks. A malicious symlink can point to arbitrary locations on the host and it will become mounted inside the sandbox.(CVE-2026-90616)

Record
OESA-2026-4098
CVSS 3.1
7.4 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:80497 8.8

Red Hat Security Advisory: flatpak security update

Record
RHSA-2026:80497
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:80498 8.8

Red Hat Security Advisory: flatpak security update

Record
RHSA-2026:80498
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:80687 8.8

Red Hat Security Advisory: flatpak security update

Record
RHSA-2026:80687
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:80497 8.8

Important: flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

  • flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)

  • flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)

  • flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)

  • flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:80497
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:80498 8.8

Important: flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

  • flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)

  • flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)

  • flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)

  • flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:80498
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:80687 8.8

Important: flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

  • flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)

  • flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)

  • flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)

  • flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:80687
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-90616 7.4

In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak creates a few app data directories (e.g., /var/cache, /var/data, /var/config, and /var/tmp) in every sandbox on every app launch where, in some cases, components of the path are attacker-controlled. Missing symlink protection can redirect the directories. Some of these directories are bind-mounted by Flatpak by passing the path (e.g., /home/user/.var/app/APP_ID/cache/tmp), which contains attacker-controlled directories (tmp) to bwrap --bind SRC DST. bwrap passes the path on to the kernel, which then follows symlinks. A malicious symlink can point to arbitrary locations on the host and it will become mounted inside the sandbox.

Record
UBUNTU-CVE-2026-90616
CVSS 3.1
7.4 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2026:80497 No score

Important: flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

  • flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)
  • flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)
  • flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)
  • flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:80497
Updated
2026-11-02
OSVALSA-2026:80498 No score

Important: flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

  • flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)
  • flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)
  • flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)
  • flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:80498
Updated
2026-11-02
OSVALSA-2026:80687 No score

Important: flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

  • flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)
  • flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)
  • flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)
  • flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:80687
Updated
2026-11-02
OSVCLSA-2026-1789577977 No score

flatpak: Fix of CVE-2026-90616

  • CVE-2026-90616: fix symlink-following sandbox escape in app data dir creation and /var bind mounts
Record
CLSA-2026-1789577977
Updated
2026-11-02
OSVCLSA-2026-1789979782 No score

flatpak: Fix of CVE-2026-90616

  • CVE-2026-90616: fix sandbox escape via symlinked per-app data directories by creating them with glnx_chase_and_mkdirat and binding /var/cache, /var/data, /var/config and /var/tmp through chased fds
Record
CLSA-2026-1789979782
Updated
2026-11-02
OSVCLSA-2026-1790035964 No score

flatpak: Fix of CVE-2026-90616

  • CVE-2026-90616: flatpak_ensure_data_dir and flatpak_run_setup_base_argv resolved the app data subdirectories by path, so an app could replace them with symlinks between runs and have them followed during the next sandbox setup; both now resolve them with glnx_chase_and_mkdirat()/glnx_chaseat() confined beneath the app data directory
  • Update the bundled libglnx with the glnx_chaseat API the above fix needs
  • Carry the upstream regression test for the above fix
Record
CLSA-2026-1790035964
Updated
2026-11-02
OSVMGASA-2026-0342 No score

Updated flatpak package fixes security vulnerabilities

Updated flatpak package fixes security vulnerabilities. Please see the links for additional information.

Record
MGASA-2026-0342
Updated
2026-11-02
OSVSUSE-SU-2026:4610-1 No score

Security update for flatpak

This update for flatpak fixes the following issues:

  • CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host (bsc#1280236).
  • CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream (bsc#1282514).
  • CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).
  • CVE-2026-96276: arbitrary write in host context via flatpak build-init (bsc#1282516).
  • CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).
  • CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).
  • CVE-2026-96283: flatpak-system-helper: cross-user CancelPull orphans another user's ongoing pull (bsc#1282521).
  • CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on .ld.so (bsc#1282523).
  • CVE-2026-96808: revokefs symlink path traversal allows local privilege escalation via commit tampering (bsc#1282524).
Record
SUSE-SU-2026:4610-1
Updated
2026-11-02
OSVSUSE-SU-2026:4944-1 No score

Security update for flatpak

This update for flatpak fixes the following issues:

  • CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host (bsc#1280236).
  • CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream (bsc#1282514).
  • CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).
  • CVE-2026-96276: arbitrary write in host context via flatpak build-init (bsc#1282516).
  • CVE-2026-96280: buffer overflow in OCI delta stream path names (bsc#1282518).
  • CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).
  • CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).
  • CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on .ld.so (bsc#1282523).
  • CVE-2026-96808: revokefs symlink path traversal allows local privilege escalation via commit tampering (bsc#1282524).

Changes for flatpak:

  • Update to version 1.16.6 (jsc#PED-17048):
  • Fix file descriptor leaks affecting Chromium-based browsers.
  • Fix installing extra-data without a runtime, including openh264.
  • Fix unusable sandbox-expose paths affecting Epiphany.
  • Fix installed tests and handling of file descriptor arguments.
  • Changes from version 1.16.5:
  • Fix regressions from the sandbox escape security fix affecting browsers, browser-based apps and Steam.
  • Expand test coverage of flatpak-run features used by the portal.
  • Changes from version 1.16.4:
  • Prevent arbitrary file reads in the system-helper context (GHSA-2fxp-43j9-pwvc).
  • Prevent orphaning cross-user pull operations (GHSA-89xm-3m96-w3jg).
  • Changes from version 1.16.3:
  • Be selective about mapping font-dirs.xml in flatpak build.
  • Changes from version 1.16.2:
  • Support reinstalling bundle installations and Intel Xe VA-API.
  • Add cancellation support for curl downloads.
  • Fix font configuration, mask and pin configuration reloads, unintended home directory access, flatpak kill, OCI support, memory leaks and crashes.
  • Changes from version 1.16.1:
  • Allow updating existing apps under parental controls by default.
  • Use instance IDs for systemd scopes and include /dev/udmabuf with --device=dri.
  • Speed up prune --dry-run and permission-reset.
  • Support TLS certificates in /etc/containers/certs.d for OCI.
  • Fix portal crashes, sandbox environment handling, accessibility bus discovery, error reporting and shell completion.
  • Update documentation and translations.
Record
SUSE-SU-2026:4944-1
Updated
2026-11-02
OSVSUSE-SU-2026:5127-1 No score

Security update for flatpak

This update for flatpak fixes the following issues:

  • CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options (bsc#1261769).
  • CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation (bsc#1261770).
  • CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host (bsc#1280236).
  • CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream (bsc#1282514).
  • CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).
  • CVE-2026-96276: arbitrary write in host context via flatpak build-init (bsc#1282516).
  • CVE-2026-96280: buffer overflow in OCI delta stream path names (bsc#1282518).
  • CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).
  • CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).
  • CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on .ld.so (bsc#1282523).
  • CVE-2026-96808: revokefs symlink path traversal allows local privilege escalation via commit tampering (bsc#1282524).

Changes for flatpak:

  • Update to version 1.16.6 (jsc#PED-17048):
  • Fix file descriptor leaks affecting Chromium-based browsers.
  • Fix installing extra-data without a runtime, including OpenH264.
  • Ignore unusable sandbox-expose paths for portal sub-sandboxes, fixing Epiphany regressions.
  • Fix installed tests and handling of standard file descriptors passed as invalid flatpak run arguments.
  • Switch from Autotools to Meson, preserving system bubblewrap, xdg-dbus-proxy, curl and distribution-specific installation paths.
  • Require bubblewrap >= 0.10.0 and GPGME >= 1.8.0; add Meson, gettext, gtk-doc and polkit-agent build dependencies and drop obsolete intltool and libelf build dependencies.
  • Generate the system-user pre-script from the Meson build directory and package the tmpfiles configuration and renamed manual pages.
Record
SUSE-SU-2026:5127-1
Updated
2026-11-07

Affected products

Affected packages

Affected packages
PackageAffectedFixed
flatpak
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1.12.9-4.el9_8.4
1.12.9-4.el9_8.4
flatpak-devel
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1.12.9-4.el9_8.4
1.12.9-4.el9_8.4
flatpak-libs
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1.12.9-4.el9_8.4
1.12.9-4.el9_8.4
flatpak-selinux
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1.12.9-4.el9_8.4
1.12.9-4.el9_8.4
flatpak-session-helper
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1.12.9-4.el9_8.4
1.12.9-4.el9_8.4
flatpak
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1.16.0-9.el10_2.4
1.16.0-9.el10_2.4
flatpak-devel
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1.16.0-9.el10_2.4
1.16.0-9.el10_2.4
flatpak-libs
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1.16.0-9.el10_2.4
1.16.0-9.el10_2.4
flatpak-selinux
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1.16.0-9.el10_2.4
1.16.0-9.el10_2.4
flatpak-session-helper
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1.16.0-9.el10_2.4
1.16.0-9.el10_2.4
Show 91 moreShow less
Affected packages
PackageAffectedFixed
flatpak
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.12.9-7.el8_10
1.12.9-7.el8_10
flatpak-devel
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.12.9-7.el8_10
1.12.9-7.el8_10
flatpak-libs
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.12.9-7.el8_10
1.12.9-7.el8_10
flatpak-selinux
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.12.9-7.el8_10
1.12.9-7.el8_10
flatpak-session-helper
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.12.9-7.el8_10
1.12.9-7.el8_10
flatpak
TuxCare:CentOS:7
 before 1.0.9-13.el7_9.tuxcare.els5
1.0.9-13.el7_9.tuxcare.els5
flatpak-builder
TuxCare:CentOS:7
 before 1.0.0-13.el7_9.tuxcare.els5
1.0.0-13.el7_9.tuxcare.els5
flatpak-devel
TuxCare:CentOS:7
 before 1.0.9-13.el7_9.tuxcare.els5
1.0.9-13.el7_9.tuxcare.els5
flatpak-libs
TuxCare:CentOS:7
 before 1.0.9-13.el7_9.tuxcare.els5
1.0.9-13.el7_9.tuxcare.els5
flatpak
TuxCare:AlmaLinux:9.2
 before 1.12.7-2.el9_2.tuxcare.els7
1.12.7-2.el9_2.tuxcare.els7
flatpak-devel
TuxCare:AlmaLinux:9.2
 before 1.12.7-2.el9_2.tuxcare.els7
1.12.7-2.el9_2.tuxcare.els7
flatpak-libs
TuxCare:AlmaLinux:9.2
 before 1.12.7-2.el9_2.tuxcare.els7
1.12.7-2.el9_2.tuxcare.els7
flatpak-selinux
TuxCare:AlmaLinux:9.2
 before 1.12.7-2.el9_2.tuxcare.els7
1.12.7-2.el9_2.tuxcare.els7
flatpak-session-helper
TuxCare:AlmaLinux:9.2
 before 1.12.7-2.el9_2.tuxcare.els7
1.12.7-2.el9_2.tuxcare.els7
flatpak-tests
TuxCare:AlmaLinux:9.2
 before 1.12.7-2.el9_2.tuxcare.els7
1.12.7-2.el9_2.tuxcare.els7
flatpak
TuxCare:AlmaLinux:9.6
 before 1.12.9-4.el9_6.tuxcare.els3
1.12.9-4.el9_6.tuxcare.els3
flatpak-devel
TuxCare:AlmaLinux:9.6
 before 1.12.9-4.el9_6.tuxcare.els3
1.12.9-4.el9_6.tuxcare.els3
flatpak-libs
TuxCare:AlmaLinux:9.6
 before 1.12.9-4.el9_6.tuxcare.els3
1.12.9-4.el9_6.tuxcare.els3
flatpak-selinux
TuxCare:AlmaLinux:9.6
 before 1.12.9-4.el9_6.tuxcare.els3
1.12.9-4.el9_6.tuxcare.els3
flatpak-session-helper
TuxCare:AlmaLinux:9.6
 before 1.12.9-4.el9_6.tuxcare.els3
1.12.9-4.el9_6.tuxcare.els3
flatpak-tests
TuxCare:AlmaLinux:9.6
 before 1.12.9-4.el9_6.tuxcare.els3
1.12.9-4.el9_6.tuxcare.els3
flatpak
Debian:12
 All versions, plus listed versions
1.14.10-11.14.10-1~deb12u11.14.10-1~deb12u21.14.4-11.14.4-1+deb12u1
Show 45 moreShow less
1.14.4-1+deb12u1~bpo11+11.14.4-21.14.5-11.14.6-11.14.6-1~deb13u11.14.8-11.14.8-1~deb12u11.15.0-11.15.0-21.15.1-11.15.10-11.15.12-11.15.2-11.15.3-11.15.4-11.15.6-11.15.7-11.15.8-11.15.9-11.15.91-11.16.0-11.16.0-21.16.0-2~bpo12+11.16.1-11.16.1-1~bpo12+11.16.1-21.16.1-31.16.2-11.16.2-1~deb13u11.16.3-11.16.3-1~deb13u11.16.4-11.16.4-21.16.5-11.16.6-11.16.6-1~deb13u11.16.6-1~deb13u1~bpo12+11.16.6-1~deb13u21.16.6-1~deb13u31.17.2-11.17.3-11.17.3-21.17.6-11.18.0-11.18.1-1
 None known
flatpak
Debian:13
 before 1.16.6-1~deb13u3, plus listed versions
1.16.1-11.16.1-21.16.1-31.16.2-11.16.2-1~deb13u1
Show 8 moreShow less
1.16.3-11.16.3-1~deb13u11.16.4-11.16.4-21.16.5-11.16.6-1~deb13u11.16.6-1~deb13u1~bpo12+11.16.6-1~deb13u2
1.16.6-1~deb13u3
flatpak
Debian:14
 before 1.18.1-1, plus listed versions
1.16.1-11.16.1-21.16.1-31.16.2-11.16.2-1~deb13u1
Show 15 moreShow less
1.16.3-11.16.3-1~deb13u11.16.4-11.16.4-21.16.5-11.16.6-11.16.6-1~deb13u11.16.6-1~deb13u1~bpo12+11.16.6-1~deb13u21.16.6-1~deb13u31.17.2-11.17.3-11.17.3-21.17.6-11.18.0-1
1.18.1-1
flatpak
Mageia:10
From an advisory covering 2 CVEs
 before 1.16.6-1.1.mga10
1.16.6-1.1.mga10
flatpak
openEuler:24.03-LTS-SP4
 before 1.10.2-13.oe2403sp4
1.10.2-13.oe2403sp4
flatpak
openEuler:20.03-LTS-SP4
 before 1.0.3-16.oe2003sp4
1.0.3-16.oe2003sp4
flatpak
openEuler:22.03-LTS-SP4
 before 1.10.2-13.oe2203sp4
1.10.2-13.oe2203sp4
flatpak
openEuler:24.03-LTS-SP1
 before 1.10.2-13.oe2403sp1
1.10.2-13.oe2403sp1
flatpak
openEuler:24.03-LTS-SP3
 before 1.10.2-13.oe2403sp3
1.10.2-13.oe2403sp3
flatpak
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak-selinux
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak-session-helper
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak-session-helper-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak-tests-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak
Red Hat:enterprise_linux:9::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak-debugsource
Red Hat:enterprise_linux:9::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak-devel
Red Hat:enterprise_linux:9::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak-libs-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak-session-helper
Red Hat:enterprise_linux:9::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak-session-helper-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak-tests-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.16.0-9.el10_2.4
0:1.16.0-9.el10_2.4
flatpak-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.16.0-9.el10_2.4
0:1.16.0-9.el10_2.4
flatpak-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.16.0-9.el10_2.4
0:1.16.0-9.el10_2.4
flatpak-libs
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.16.0-9.el10_2.4
0:1.16.0-9.el10_2.4
flatpak-libs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.16.0-9.el10_2.4
0:1.16.0-9.el10_2.4
flatpak-selinux
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.16.0-9.el10_2.4
0:1.16.0-9.el10_2.4
flatpak-session-helper
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.16.0-9.el10_2.4
0:1.16.0-9.el10_2.4
flatpak-session-helper-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.16.0-9.el10_2.4
0:1.16.0-9.el10_2.4
flatpak-tests-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.16.0-9.el10_2.4
0:1.16.0-9.el10_2.4
flatpak-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.16.0-9.el10_2.4
0:1.16.0-9.el10_2.4
flatpak
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak-selinux
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak-session-helper
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak-session-helper-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak-tests-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak
Red Hat:enterprise_linux:8::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak-debugsource
Red Hat:enterprise_linux:8::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak-devel
Red Hat:enterprise_linux:8::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak-libs-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak-session-helper
Red Hat:enterprise_linux:8::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak-session-helper-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak-tests-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak
Rocky Linux:9
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak
Rocky Linux:10
From an advisory covering 4 CVEs
 before 0:1.16.0-9.el10_2.4
0:1.16.0-9.el10_2.4
flatpak
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 9 CVEs
 before 1.4.2-3.15.1
1.4.2-3.15.1
flatpak
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 9 CVEs
 before 1.4.2-3.15.1
1.4.2-3.15.1
flatpak
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
From an advisory covering 9 CVEs
 before 1.16.6-150600.3.12.1
1.16.6-150600.3.12.1
flatpak
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 9 CVEs
 before 1.16.6-150600.3.12.1
1.16.6-150600.3.12.1
flatpak
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 9 CVEs
 before 1.16.6-150600.3.12.1
1.16.6-150600.3.12.1
flatpak
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 11 CVEs
 before 1.16.6-150500.3.21.1
1.16.6-150500.3.21.1
flatpak
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 11 CVEs
 before 1.16.6-150500.3.21.1
1.16.6-150500.3.21.1
flatpak
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 11 CVEs
 before 1.16.6-150500.3.21.1
1.16.6-150500.3.21.1
flatpak
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 11 CVEs
 before 1.16.6-150500.3.21.1
1.16.6-150500.3.21.1
flatpak
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
0.8.7-50.10.0-10.10.0-20.10.1-10.10.2-1
Show 16 moreShow less
0.10.2.1-10.10.2.1-20.10.3-10.11.1-0ubuntu10.11.3-20.11.3-30.11.7-0ubuntu0.11.0.1-0ubuntu0.11.0.6-0ubuntu0.11.0.7-0ubuntu0.18.04.11.0.8-0ubuntu0.18.04.11.0.9-0ubuntu0.11.0.9-0ubuntu0.21.0.9-0ubuntu0.31.0.9-0ubuntu0.41.0.9-0ubuntu0.4+esm1
 None known
flatpak
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.4.3-11.6.0-11.6.1-11.6.2-11.6.3-1
Show 6 moreShow less
1.6.5-0ubuntu0.11.6.5-0ubuntu0.21.6.5-0ubuntu0.31.6.5-0ubuntu0.41.6.5-0ubuntu0.51.6.5-0ubuntu0.5+esm1
 None known
flatpak
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.10.2-31.12.2-11.12.2-21.12.3-11.12.4-1
Show 5 moreShow less
1.12.5-11.12.6-11.12.7-11.12.7-1ubuntu0.11.12.7-1ubuntu0.1+esm1
 None known
flatpak
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.14.4-21.14.5-11.14.5-1build11.14.5-1build41.14.5-1build5
Show 4 moreShow less
1.14.5-1build61.14.6-11.14.6-1ubuntu0.11.14.6-1ubuntu0.1+esm1
 None known
flatpak
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.16.1-2ubuntu11.16.1-3ubuntu11.16.2-11.16.3-11.16.3-1build11.16.4-11.16.4-21.16.6-1
 None known

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-90616 is a high vulnerability (CVSS 7.4) in Flatpak, published August 31, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in flatpak 1.0.9-13.el7_9.tuxcare.els5.

References

Show 78 moreShow less
This page doesn't list everything

Left out here: 3 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open