CVE-2026-96283
Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pull
By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pull
By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.
- Record
CVE-2026-96283- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-862
- Updated
- 2026-11-06
EUVDEUVD-2026-88043
By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.
- Record
EUVD-2026-88043- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-06
NVD
By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.
- Record
CVE-2026-96283- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-862
- Updated
- 2026-11-06
OSVDEBIAN-CVE-2026-96283
By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.
- Record
DEBIAN-CVE-2026-96283- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-07
OSVOESA-2026-4308
flatpak security update
flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.
Security Fix(es):
A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.(CVE-2026-96282)
By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.(CVE-2026-96283)
- Record
OESA-2026-4308- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVOESA-2026-4309
flatpak security update
flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.
Security Fix(es):
A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.(CVE-2026-96282)
By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.(CVE-2026-96283)
- Record
OESA-2026-4309- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Show 4 moreShow less
OSVOESA-2026-4310
flatpak security update
flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.
Security Fix(es):
A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.(CVE-2026-96282)
By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.(CVE-2026-96283)
- Record
OESA-2026-4310- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVOESA-2026-4311
flatpak security update
flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.
Security Fix(es):
A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.(CVE-2026-96282)
By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.(CVE-2026-96283)
- Record
OESA-2026-4311- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-96283
By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.
- Record
UBUNTU-CVE-2026-96283- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVSUSE-SU-2026:4610-1 No score
Security update for flatpak
This update for flatpak fixes the following issues:
- CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host (bsc#1280236).
- CVE-2026-92162: path traversal via unvalidated
archparameter inDeployAppstream(bsc#1282514). - CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).
- CVE-2026-96276: arbitrary write in host context via
flatpak build-init(bsc#1282516). - CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).
- CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).
- CVE-2026-96283: flatpak-system-helper: cross-user
CancelPullorphans another user's ongoing pull (bsc#1282521). - CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on
.ld.so(bsc#1282523). - CVE-2026-96808:
revokefssymlink path traversal allows local privilege escalation via commit tampering (bsc#1282524).
- Record
SUSE-SU-2026:4610-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flatpakDebian:12 |
before 1.14.10-1~deb12u2, plus listed versions 1.14.10-1~deb12u11.14.4-11.14.4-1+deb12u11.14.4-1+deb12u1~bpo11+11.14.4-2 Show 5 moreShow less1.14.5-11.14.6-11.14.6-1~deb13u11.14.8-11.14.8-1~deb12u1 |
1.14.10-1~deb12u2 |
flatpakDebian:13 |
before 1.16.4-1, plus listed versions 1.16.1-11.16.1-21.16.1-31.16.2-11.16.2-1~deb13u11.16.3-11.16.3-1~deb13u1 |
1.16.4-1 |
flatpakDebian:14 |
before 1.16.4-1, plus listed versions 1.16.1-11.16.1-21.16.1-31.16.2-11.16.2-1~deb13u11.16.3-11.16.3-1~deb13u1 |
1.16.4-1 |
flatpakopenEuler:24.03-LTS-SP1 From an advisory covering 2 CVEs |
before 1.10.2-15.oe2403sp1 | 1.10.2-15.oe2403sp1 |
flatpakopenEuler:24.03-LTS-SP3 From an advisory covering 2 CVEs |
before 1.10.2-15.oe2403sp3 | 1.10.2-15.oe2403sp3 |
flatpakopenEuler:24.03-LTS-SP4 From an advisory covering 2 CVEs |
before 1.10.2-15.oe2403sp4 | 1.10.2-15.oe2403sp4 |
flatpakopenEuler:22.03-LTS-SP4 From an advisory covering 2 CVEs |
before 1.10.2-15.oe2203sp4 | 1.10.2-15.oe2203sp4 |
flatpakSUSE:Linux Enterprise Server 12 SP5-LTSS From an advisory covering 9 CVEs |
before 1.4.2-3.15.1 | 1.4.2-3.15.1 |
flatpakSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 9 CVEs |
before 1.4.2-3.15.1 | 1.4.2-3.15.1 |
flatpakUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 0.8.7-50.10.0-10.10.0-20.10.1-10.10.2-1 Show 16 moreShow less0.10.2.1-10.10.2.1-20.10.3-10.11.1-0ubuntu10.11.3-20.11.3-30.11.7-0ubuntu0.11.0.1-0ubuntu0.11.0.6-0ubuntu0.11.0.7-0ubuntu0.18.04.11.0.8-0ubuntu0.18.04.11.0.9-0ubuntu0.11.0.9-0ubuntu0.21.0.9-0ubuntu0.31.0.9-0ubuntu0.41.0.9-0ubuntu0.4+esm1 |
None known |
flatpakUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.4.3-11.6.0-11.6.1-11.6.2-11.6.3-1 Show 6 moreShow less1.6.5-0ubuntu0.11.6.5-0ubuntu0.21.6.5-0ubuntu0.31.6.5-0ubuntu0.41.6.5-0ubuntu0.51.6.5-0ubuntu0.5+esm1 |
None known |
flatpakUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.10.2-31.12.2-11.12.2-21.12.3-11.12.4-1 Show 5 moreShow less1.12.5-11.12.6-11.12.7-11.12.7-1ubuntu0.11.12.7-1ubuntu0.1+esm1 |
None known |
flatpakUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 1.14.4-21.14.5-11.14.5-1build11.14.5-1build41.14.5-1build5 Show 4 moreShow less1.14.5-1build61.14.6-11.14.6-1ubuntu0.11.14.6-1ubuntu0.1+esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-96283 is a low vulnerability (CVSS 3.3) in Red Hat Enterprise Linux 10, published September 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.11%, the 1st percentile. Fixed in flatpak 1.14.10-1~deb12u2.
References
access.redhat.com/security/cve/CVE-2026-96283
bugzilla.redhat.com/show_bug.cgi?id=2539424
github.com/flatpak/flatpak/security/advisories/GHSA-89xm-3m96-w3jg
security-tracker.debian.org/tracker/CVE-2026-96283
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-4308
nvd.nist.gov/vuln/detail/CVE-2026-96282
Show 25 moreShow less
suse.com/support/update/announcement/2026/suse-su-20264610-1
bugzilla.suse.com/1280236
ubuntu.com/security/CVE-2026-96283
cve.org/CVERecord?id=CVE-2026-96283