Every CVE Search/ Get API key

CVE-2026-96808

Important: flatpak security update

7.4 HighFix available

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two revokefs sessions via the system helper, create a symlink in one session pointing into the other session's directory, and retain a file descriptor through that symlink. This allowed the attacker to modify files belonging to a different revokefs session after they had been validated and imported by the system helper. In particular, an attacker could use this to tamper with ostree commit objects in the system repository after they passed signature verification, enabling root-controlled file writes to attacker-chosen paths and local root privilege escalation.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.11%Unchanged since Sep 24, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.4

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two revokefs sessions via the system helper, create a symlink in one session pointing into the other session's directory, and retain a file descriptor through that symlink. This allowed the attacker to modify files belonging to a different revokefs session after they had been validated and imported by the system helper. In particular, an attacker could use this to tamper with ostree commit objects in the system repository after they passed signature verification, enabling root-controlled file writes to attacker-chosen paths and local root privilege escalation.

Record
CVE-2026-96808
CVSS 3.1
7.4 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-61
Updated
2026-11-02
EUVDEUVD-2026-85424 7.4

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two revokefs sessions via the system helper, create a symlink in one session pointing into the other session's directory, and retain a file descriptor through that symlink. This allowed the attacker to modify files belonging to a different revokefs session after they had been validated and imported by the system helper. In particular, an attacker could use this to tamper with ostree commit objects in the system repository after they passed signature verification, enabling root-controlled file writes to attacker-chosen paths and local root privilege escalation.

Record
EUVD-2026-85424
CVSS 3.1
7.4 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
NVD 7.4

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two revokefs sessions via the system helper, create a symlink in one session pointing into the other session's directory, and retain a file descriptor through that symlink. This allowed the attacker to modify files belonging to a different revokefs session after they had been validated and imported by the system helper. In particular, an attacker could use this to tamper with ostree commit objects in the system repository after they passed signature verification, enabling root-controlled file writes to attacker-chosen paths and local root privilege escalation.

Record
CVE-2026-96808
CVSS 3.1
7.4 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-61
Updated
2026-11-02
OSV 7.4

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two revokefs sessions via the system helper, create a symlink in one session pointing into the other session's directory, and retain a file descriptor through that symlink. This allowed the attacker to modify files belonging to a different revokefs session after they had been validated and imported by the system helper. In particular, an attacker could use this to tamper with ostree commit objects in the system repository after they passed signature verification, enabling root-controlled file writes to attacker-chosen paths and local root privilege escalation.

Record
CVE-2026-96808
CVSS 3.1
7.4 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-61
Updated
2026-11-07
OSVDEBIAN-CVE-2026-96808 7.4

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two revokefs sessions via the system helper, create a symlink in one session pointing into the other session's directory, and retain a file descriptor through that symlink. This allowed the attacker to modify files belonging to a different revokefs session after they had been validated and imported by the system helper. In particular, an attacker could use this to tamper with ostree commit objects in the system repository after they passed signature verification, enabling root-controlled file writes to attacker-chosen paths and local root privilege escalation.

Record
DEBIAN-CVE-2026-96808
CVSS 3.1
7.4 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-4569 7.4

flatpak security update

flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.

Security Fix(es):

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two revokefs sessions via the system helper, create a symlink in one session pointing into the other session's directory, and retain a file descriptor through that symlink. This allowed the attacker to modify files belonging to a different revokefs session after they had been validated and imported by the system helper. In particular, an attacker could use this to tamper with ostree commit objects in the system repository after they passed signature verification, enabling root-controlled file writes to attacker-chosen paths and local root privilege escalation.(CVE-2026-96808)

Record
OESA-2026-4569
CVSS 3.1
7.4 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 16 moreShow less
OSVOESA-2026-4571 7.4

flatpak security update

flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.

Security Fix(es):

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two revokefs sessions via the system helper, create a symlink in one session pointing into the other session's directory, and retain a file descriptor through that symlink. This allowed the attacker to modify files belonging to a different revokefs session after they had been validated and imported by the system helper. In particular, an attacker could use this to tamper with ostree commit objects in the system repository after they passed signature verification, enabling root-controlled file writes to attacker-chosen paths and local root privilege escalation.(CVE-2026-96808)

Record
OESA-2026-4571
CVSS 3.1
7.4 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:80497 8.8

Red Hat Security Advisory: flatpak security update

Record
RHSA-2026:80497
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:80498 8.8

Red Hat Security Advisory: flatpak security update

Record
RHSA-2026:80498
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:80687 8.8

Red Hat Security Advisory: flatpak security update

Record
RHSA-2026:80687
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:80497 8.8

Important: flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

  • flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)

  • flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)

  • flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)

  • flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:80497
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:80498 8.8

Important: flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

  • flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)

  • flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)

  • flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)

  • flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:80498
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:80687 8.8

Important: flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

  • flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)

  • flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)

  • flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)

  • flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:80687
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-96808 7.4

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two revokefs sessions via the system helper, create a symlink in one session pointing into the other session's directory, and retain a file descriptor through that symlink. This allowed the attacker to modify files belonging to a different revokefs session after they had been validated and imported by the system helper. In particular, an attacker could use this to tamper with ostree commit objects in the system repository after they passed signature verification, enabling root-controlled file writes to attacker-chosen paths and local root privilege escalation.

Record
UBUNTU-CVE-2026-96808
CVSS 3.1
7.4 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2026:80497 No score

Important: flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

  • flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)
  • flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)
  • flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)
  • flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:80497
Updated
2026-11-02
OSVALSA-2026:80498 No score

Important: flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

  • flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)
  • flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)
  • flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)
  • flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:80498
Updated
2026-11-02
OSVALSA-2026:80687 No score

Important: flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

  • flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)
  • flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)
  • flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)
  • flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:80687
Updated
2026-11-02
OSVCLSA-2026-1790844951 No score

flatpak: Fix of CVE-2026-96808

  • CVE-2026-96808: the revokefs writer validated the paths its unprivileged client sends with validate_path()/get_valid_path(), which rejected literal ".." components but followed symlinks, so a local user holding two revokefs sessions could make one session write through a symlink into the other and tamper with ostree objects after flatpak-system-helper had verified them; the request handlers now resolve the parent directory with glnx_chaseat(GLNX_CHASE_RESOLVE_BENEATH) through the new chase_parent(), chase_request_path(), chase_request_2path() and chase_request_any_and_path() helpers and act on the final component with *at() syscalls confined beneath basefd
Record
CLSA-2026-1790844951
Updated
2026-11-02
OSVCLSA-2026-1791735799 No score

flatpak: Fix of CVE-2026-96808

  • CVE-2026-96808: fix local privilege escalation via symlink path traversal in the revokefs writer used by flatpak-system-helper
Record
CLSA-2026-1791735799
Updated
2026-11-02
OSVSUSE-SU-2026:4610-1 No score

Security update for flatpak

This update for flatpak fixes the following issues:

  • CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host (bsc#1280236).
  • CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream (bsc#1282514).
  • CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).
  • CVE-2026-96276: arbitrary write in host context via flatpak build-init (bsc#1282516).
  • CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).
  • CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).
  • CVE-2026-96283: flatpak-system-helper: cross-user CancelPull orphans another user's ongoing pull (bsc#1282521).
  • CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on .ld.so (bsc#1282523).
  • CVE-2026-96808: revokefs symlink path traversal allows local privilege escalation via commit tampering (bsc#1282524).
Record
SUSE-SU-2026:4610-1
Updated
2026-11-02
OSVSUSE-SU-2026:4944-1 No score

Security update for flatpak

This update for flatpak fixes the following issues:

  • CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host (bsc#1280236).
  • CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream (bsc#1282514).
  • CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).
  • CVE-2026-96276: arbitrary write in host context via flatpak build-init (bsc#1282516).
  • CVE-2026-96280: buffer overflow in OCI delta stream path names (bsc#1282518).
  • CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).
  • CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).
  • CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on .ld.so (bsc#1282523).
  • CVE-2026-96808: revokefs symlink path traversal allows local privilege escalation via commit tampering (bsc#1282524).

Changes for flatpak:

  • Update to version 1.16.6 (jsc#PED-17048):
  • Fix file descriptor leaks affecting Chromium-based browsers.
  • Fix installing extra-data without a runtime, including openh264.
  • Fix unusable sandbox-expose paths affecting Epiphany.
  • Fix installed tests and handling of file descriptor arguments.
  • Changes from version 1.16.5:
  • Fix regressions from the sandbox escape security fix affecting browsers, browser-based apps and Steam.
  • Expand test coverage of flatpak-run features used by the portal.
  • Changes from version 1.16.4:
  • Prevent arbitrary file reads in the system-helper context (GHSA-2fxp-43j9-pwvc).
  • Prevent orphaning cross-user pull operations (GHSA-89xm-3m96-w3jg).
  • Changes from version 1.16.3:
  • Be selective about mapping font-dirs.xml in flatpak build.
  • Changes from version 1.16.2:
  • Support reinstalling bundle installations and Intel Xe VA-API.
  • Add cancellation support for curl downloads.
  • Fix font configuration, mask and pin configuration reloads, unintended home directory access, flatpak kill, OCI support, memory leaks and crashes.
  • Changes from version 1.16.1:
  • Allow updating existing apps under parental controls by default.
  • Use instance IDs for systemd scopes and include /dev/udmabuf with --device=dri.
  • Speed up prune --dry-run and permission-reset.
  • Support TLS certificates in /etc/containers/certs.d for OCI.
  • Fix portal crashes, sandbox environment handling, accessibility bus discovery, error reporting and shell completion.
  • Update documentation and translations.
Record
SUSE-SU-2026:4944-1
Updated
2026-11-02
OSVSUSE-SU-2026:5127-1 No score

Security update for flatpak

This update for flatpak fixes the following issues:

  • CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options (bsc#1261769).
  • CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation (bsc#1261770).
  • CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host (bsc#1280236).
  • CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream (bsc#1282514).
  • CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).
  • CVE-2026-96276: arbitrary write in host context via flatpak build-init (bsc#1282516).
  • CVE-2026-96280: buffer overflow in OCI delta stream path names (bsc#1282518).
  • CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).
  • CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).
  • CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on .ld.so (bsc#1282523).
  • CVE-2026-96808: revokefs symlink path traversal allows local privilege escalation via commit tampering (bsc#1282524).

Changes for flatpak:

  • Update to version 1.16.6 (jsc#PED-17048):
  • Fix file descriptor leaks affecting Chromium-based browsers.
  • Fix installing extra-data without a runtime, including OpenH264.
  • Ignore unusable sandbox-expose paths for portal sub-sandboxes, fixing Epiphany regressions.
  • Fix installed tests and handling of standard file descriptors passed as invalid flatpak run arguments.
  • Switch from Autotools to Meson, preserving system bubblewrap, xdg-dbus-proxy, curl and distribution-specific installation paths.
  • Require bubblewrap >= 0.10.0 and GPGME >= 1.8.0; add Meson, gettext, gtk-doc and polkit-agent build dependencies and drop obsolete intltool and libelf build dependencies.
  • Generate the system-user pre-script from the Meson build directory and package the tmpfiles configuration and renamed manual pages.
Record
SUSE-SU-2026:5127-1
Updated
2026-11-07

Affected products

Affected packages

Affected packages
PackageAffectedFixed
flatpak
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1.12.9-4.el9_8.4
1.12.9-4.el9_8.4
flatpak-devel
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1.12.9-4.el9_8.4
1.12.9-4.el9_8.4
flatpak-libs
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1.12.9-4.el9_8.4
1.12.9-4.el9_8.4
flatpak-selinux
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1.12.9-4.el9_8.4
1.12.9-4.el9_8.4
flatpak-session-helper
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1.12.9-4.el9_8.4
1.12.9-4.el9_8.4
flatpak
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1.16.0-9.el10_2.4
1.16.0-9.el10_2.4
flatpak-devel
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1.16.0-9.el10_2.4
1.16.0-9.el10_2.4
flatpak-libs
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1.16.0-9.el10_2.4
1.16.0-9.el10_2.4
flatpak-selinux
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1.16.0-9.el10_2.4
1.16.0-9.el10_2.4
flatpak-session-helper
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1.16.0-9.el10_2.4
1.16.0-9.el10_2.4
Show 83 moreShow less
Affected packages
PackageAffectedFixed
flatpak
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.12.9-7.el8_10
1.12.9-7.el8_10
flatpak-devel
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.12.9-7.el8_10
1.12.9-7.el8_10
flatpak-libs
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.12.9-7.el8_10
1.12.9-7.el8_10
flatpak-selinux
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.12.9-7.el8_10
1.12.9-7.el8_10
flatpak-session-helper
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.12.9-7.el8_10
1.12.9-7.el8_10
flatpak
TuxCare:AlmaLinux:9.6
 before 1.12.9-4.el9_6.tuxcare.els4
1.12.9-4.el9_6.tuxcare.els4
flatpak-devel
TuxCare:AlmaLinux:9.6
 before 1.12.9-4.el9_6.tuxcare.els4
1.12.9-4.el9_6.tuxcare.els4
flatpak-libs
TuxCare:AlmaLinux:9.6
 before 1.12.9-4.el9_6.tuxcare.els4
1.12.9-4.el9_6.tuxcare.els4
flatpak-selinux
TuxCare:AlmaLinux:9.6
 before 1.12.9-4.el9_6.tuxcare.els4
1.12.9-4.el9_6.tuxcare.els4
flatpak-session-helper
TuxCare:AlmaLinux:9.6
 before 1.12.9-4.el9_6.tuxcare.els4
1.12.9-4.el9_6.tuxcare.els4
flatpak-tests
TuxCare:AlmaLinux:9.6
 before 1.12.9-4.el9_6.tuxcare.els4
1.12.9-4.el9_6.tuxcare.els4
flatpak
TuxCare:AlmaLinux:9.2
 before 1.12.7-2.el9_2.tuxcare.els8
1.12.7-2.el9_2.tuxcare.els8
flatpak-devel
TuxCare:AlmaLinux:9.2
 before 1.12.7-2.el9_2.tuxcare.els8
1.12.7-2.el9_2.tuxcare.els8
flatpak-libs
TuxCare:AlmaLinux:9.2
 before 1.12.7-2.el9_2.tuxcare.els8
1.12.7-2.el9_2.tuxcare.els8
flatpak-selinux
TuxCare:AlmaLinux:9.2
 before 1.12.7-2.el9_2.tuxcare.els8
1.12.7-2.el9_2.tuxcare.els8
flatpak-session-helper
TuxCare:AlmaLinux:9.2
 before 1.12.7-2.el9_2.tuxcare.els8
1.12.7-2.el9_2.tuxcare.els8
flatpak-tests
TuxCare:AlmaLinux:9.2
 before 1.12.7-2.el9_2.tuxcare.els8
1.12.7-2.el9_2.tuxcare.els8
flatpak
Debian:12
 All versions, plus listed versions
1.14.10-11.14.10-1~deb12u11.14.10-1~deb12u21.14.4-11.14.4-1+deb12u1
Show 45 moreShow less
1.14.4-1+deb12u1~bpo11+11.14.4-21.14.5-11.14.6-11.14.6-1~deb13u11.14.8-11.14.8-1~deb12u11.15.0-11.15.0-21.15.1-11.15.10-11.15.12-11.15.2-11.15.3-11.15.4-11.15.6-11.15.7-11.15.8-11.15.9-11.15.91-11.16.0-11.16.0-21.16.0-2~bpo12+11.16.1-11.16.1-1~bpo12+11.16.1-21.16.1-31.16.2-11.16.2-1~deb13u11.16.3-11.16.3-1~deb13u11.16.4-11.16.4-21.16.5-11.16.6-11.16.6-1~deb13u11.16.6-1~deb13u1~bpo12+11.16.6-1~deb13u21.17.2-11.17.3-11.17.3-21.17.6-11.18.0-11.18.1-11.18.2-1
 None known
flatpak
Debian:13
 before 1.16.6-1~deb13u2, plus listed versions
1.16.1-11.16.1-21.16.1-31.16.2-11.16.2-1~deb13u1
Show 7 moreShow less
1.16.3-11.16.3-1~deb13u11.16.4-11.16.4-21.16.5-11.16.6-1~deb13u11.16.6-1~deb13u1~bpo12+1
1.16.6-1~deb13u2
flatpak
Debian:14
 before 1.18.1-1, plus listed versions
1.16.1-11.16.1-21.16.1-31.16.2-11.16.2-1~deb13u1
Show 14 moreShow less
1.16.3-11.16.3-1~deb13u11.16.4-11.16.4-21.16.5-11.16.6-11.16.6-1~deb13u11.16.6-1~deb13u1~bpo12+11.16.6-1~deb13u21.17.2-11.17.3-11.17.3-21.17.6-11.18.0-1
1.18.1-1
flatpak
openEuler:22.03-LTS-SP4
 before 1.10.2-16.oe2203sp4
1.10.2-16.oe2203sp4
flatpak
openEuler:24.03-LTS-SP4
 before 1.10.2-16.oe2403sp4
1.10.2-16.oe2403sp4
flatpak
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak-selinux
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak-session-helper
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak-session-helper-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak-tests-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak
Red Hat:enterprise_linux:9::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak-debugsource
Red Hat:enterprise_linux:9::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak-devel
Red Hat:enterprise_linux:9::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak-libs-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak-session-helper
Red Hat:enterprise_linux:9::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak-session-helper-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak-tests-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.16.0-9.el10_2.4
0:1.16.0-9.el10_2.4
flatpak-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.16.0-9.el10_2.4
0:1.16.0-9.el10_2.4
flatpak-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.16.0-9.el10_2.4
0:1.16.0-9.el10_2.4
flatpak-libs
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.16.0-9.el10_2.4
0:1.16.0-9.el10_2.4
flatpak-libs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.16.0-9.el10_2.4
0:1.16.0-9.el10_2.4
flatpak-selinux
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.16.0-9.el10_2.4
0:1.16.0-9.el10_2.4
flatpak-session-helper
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.16.0-9.el10_2.4
0:1.16.0-9.el10_2.4
flatpak-session-helper-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.16.0-9.el10_2.4
0:1.16.0-9.el10_2.4
flatpak-tests-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.16.0-9.el10_2.4
0:1.16.0-9.el10_2.4
flatpak-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.16.0-9.el10_2.4
0:1.16.0-9.el10_2.4
flatpak
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak-selinux
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak-session-helper
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak-session-helper-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak-tests-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak
Red Hat:enterprise_linux:8::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak-debugsource
Red Hat:enterprise_linux:8::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak-devel
Red Hat:enterprise_linux:8::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak-libs-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak-session-helper
Red Hat:enterprise_linux:8::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak-session-helper-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak-tests-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak
Rocky Linux:9
From an advisory covering 4 CVEs
 before 0:1.12.9-4.el9_8.4
0:1.12.9-4.el9_8.4
flatpak
Rocky Linux:10
From an advisory covering 4 CVEs
 before 0:1.16.0-9.el10_2.4
0:1.16.0-9.el10_2.4
flatpak
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:1.12.9-7.el8_10
0:1.12.9-7.el8_10
flatpak
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 9 CVEs
 before 1.4.2-3.15.1
1.4.2-3.15.1
flatpak
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 9 CVEs
 before 1.4.2-3.15.1
1.4.2-3.15.1
flatpak
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
From an advisory covering 9 CVEs
 before 1.16.6-150600.3.12.1
1.16.6-150600.3.12.1
flatpak
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 9 CVEs
 before 1.16.6-150600.3.12.1
1.16.6-150600.3.12.1
flatpak
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 9 CVEs
 before 1.16.6-150600.3.12.1
1.16.6-150600.3.12.1
flatpak
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 11 CVEs
 before 1.16.6-150500.3.21.1
1.16.6-150500.3.21.1
flatpak
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 11 CVEs
 before 1.16.6-150500.3.21.1
1.16.6-150500.3.21.1
flatpak
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 11 CVEs
 before 1.16.6-150500.3.21.1
1.16.6-150500.3.21.1
flatpak
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 11 CVEs
 before 1.16.6-150500.3.21.1
1.16.6-150500.3.21.1
flatpak
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
0.8.7-50.10.0-10.10.0-20.10.1-10.10.2-1
Show 16 moreShow less
0.10.2.1-10.10.2.1-20.10.3-10.11.1-0ubuntu10.11.3-20.11.3-30.11.7-0ubuntu0.11.0.1-0ubuntu0.11.0.6-0ubuntu0.11.0.7-0ubuntu0.18.04.11.0.8-0ubuntu0.18.04.11.0.9-0ubuntu0.11.0.9-0ubuntu0.21.0.9-0ubuntu0.31.0.9-0ubuntu0.41.0.9-0ubuntu0.4+esm1
 None known
flatpak
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.4.3-11.6.0-11.6.1-11.6.2-11.6.3-1
Show 6 moreShow less
1.6.5-0ubuntu0.11.6.5-0ubuntu0.21.6.5-0ubuntu0.31.6.5-0ubuntu0.41.6.5-0ubuntu0.51.6.5-0ubuntu0.5+esm1
 None known
flatpak
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.10.2-31.12.2-11.12.2-21.12.3-11.12.4-1
Show 5 moreShow less
1.12.5-11.12.6-11.12.7-11.12.7-1ubuntu0.11.12.7-1ubuntu0.1+esm1
 None known
flatpak
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.14.4-21.14.5-11.14.5-1build11.14.5-1build41.14.5-1build5
Show 4 moreShow less
1.14.5-1build61.14.6-11.14.6-1ubuntu0.11.14.6-1ubuntu0.1+esm1
 None known
flatpak
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.16.1-2ubuntu11.16.1-3ubuntu11.16.2-11.16.3-11.16.3-1build11.16.4-11.16.4-21.16.6-1
 None known

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected, facts
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-96808 is a high vulnerability (CVSS 7.4) in Flatpak, published September 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.11%, the 1st percentile. Fixed in flatpak 1.12.9-4.el9_6.tuxcare.els4.

References

Show 67 moreShow less
This page doesn't list everything

Left out here: 1 version. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open