{"id":"CVE-2026-97026","aliases":["DEBIAN-CVE-2026-97026","EUVD-2026-88553","MGASA-2026-0477","UBUNTU-CVE-2026-97026","openSUSE-SU-2026:11918-1"],"status":"published","title":"Flatpak: flatpak: world-writable temporary child repositories in system-helper cache path","description":"Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation failures (denial of service); tampered content would fail signature/digest verification rather than being trusted.","severity":{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00104,"percentile":0.01042,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-378"],"published":"2026-09-28T20:57:03Z","modified":"2026-10-17T13:01:20Z","fixes":[{"ecosystem":"Debian:13","package":"flatpak","fixed_in":["1.16.6-1~deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"flatpak","fixed_in":["1.18.4-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14.10-1","1.14.10-1~deb12u1","1.14.10-1~deb12u2","1.14.4-1","1.14.4-1+deb12u1","1.14.4-1+deb12u1~bpo11+1","1.14.4-2","1.14.5-1","1.14.6-1","1.14.6-1~deb13u1","1.14.8-1","1.14.8-1~deb12u1","1.15.0-1","1.15.0-2","1.15.1-1","1.15.10-1","1.15.12-1","1.15.2-1","1.15.3-1","1.15.4-1","1.15.6-1","1.15.7-1","1.15.8-1","1.15.9-1","1.15.91-1","1.16.0-1","1.16.0-2","1.16.0-2~bpo12+1","1.16.1-1","1.16.1-1~bpo12+1","1.16.1-2","1.16.1-3","1.16.2-1","1.16.2-1~deb13u1","1.16.3-1","1.16.3-1~deb13u1","1.16.4-1","1.16.4-2","1.16.5-1","1.16.6-1","1.16.6-1~deb13u1","1.16.6-1~deb13u1~bpo12+1","1.16.6-1~deb13u2","1.16.6-1~deb13u3","1.17.2-1","1.17.3-1","1.17.3-2","1.17.6-1","1.18.0-1","1.18.1-1","1.18.2-1","1.18.3-1","1.18.4-1"]},{"source":"osv","ecosystem":"Debian:13","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-1~deb13u3"}]}],"versions":["1.16.1-1","1.16.1-2","1.16.1-3","1.16.2-1","1.16.2-1~deb13u1","1.16.3-1","1.16.3-1~deb13u1","1.16.4-1","1.16.4-2","1.16.5-1","1.16.6-1~deb13u1","1.16.6-1~deb13u1~bpo12+1","1.16.6-1~deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-1"}]}],"versions":["1.16.1-1","1.16.1-2","1.16.1-3","1.16.2-1","1.16.2-1~deb13u1","1.16.3-1","1.16.3-1~deb13u1","1.16.4-1","1.16.4-2","1.16.5-1","1.16.6-1","1.16.6-1~deb13u1","1.16.6-1~deb13u1~bpo12+1","1.16.6-1~deb13u2","1.16.6-1~deb13u3","1.17.2-1","1.17.3-1","1.17.3-2","1.17.6-1","1.18.0-1","1.18.1-1","1.18.2-1","1.18.3-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-1.2.mga10"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.7-5","0.10.0-1","0.10.0-2","0.10.1-1","0.10.2-1","0.10.2.1-1","0.10.2.1-2","0.10.3-1","0.11.1-0ubuntu1","0.11.3-2","0.11.3-3","0.11.7-0ubuntu0.1","1.0.1-0ubuntu0.1","1.0.6-0ubuntu0.1","1.0.7-0ubuntu0.18.04.1","1.0.8-0ubuntu0.18.04.1","1.0.9-0ubuntu0.1","1.0.9-0ubuntu0.2","1.0.9-0ubuntu0.3","1.0.9-0ubuntu0.4","1.0.9-0ubuntu0.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.3-1","1.6.0-1","1.6.1-1","1.6.2-1","1.6.3-1","1.6.5-0ubuntu0.1","1.6.5-0ubuntu0.2","1.6.5-0ubuntu0.3","1.6.5-0ubuntu0.4","1.6.5-0ubuntu0.5","1.6.5-0ubuntu0.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.2-3","1.12.2-1","1.12.2-2","1.12.3-1","1.12.4-1","1.12.5-1","1.12.6-1","1.12.7-1","1.12.7-1ubuntu0.1","1.12.7-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14.4-2","1.14.5-1","1.14.5-1build1","1.14.5-1build4","1.14.5-1build5","1.14.5-1build6","1.14.6-1","1.14.6-1ubuntu0.1","1.14.6-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.6-1","1.18.0-1","1.18.1-1","1.18.2-1","1.18.4-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.1-2ubuntu1","1.16.1-3ubuntu1","1.16.2-1","1.16.3-1","1.16.3-1build1","1.16.4-1","1.16.4-2","1.16.6-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-1.1"}]}],"bundled":6}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-97026","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542637","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-r9w3-qx54-qvc8","tags":["advisory","report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-97026","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0477.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36401","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/28/6","tags":["web"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-8xgq-v545-vgvf","tags":["advisory"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-5p67-xh8x-rq54","tags":["advisory"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-7rvf-rqr3-43j4","tags":["advisory"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-v64f-hrwr-j4vh","tags":["advisory"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-f3p8-vr7v-gxf2","tags":["advisory"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00437.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-97026","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-97026","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97029","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-97026","title":"Flatpak: flatpak: world-writable temporary child repositories in system-helper cache path","description":"Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation failures (denial of service); tampered content would fail signature/digest verification rather than being trusted.","status":"published","published":"2026-09-28T20:57:03.702Z","modified":"2026-11-06T20:01:25.676Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-378"],"updated_at":"2026-11-06T21:31:08.131839Z"}],"euvd":[{"id":"EUVD-2026-88553","description":"Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation failures (denial of service); tampered content would fail signature/digest verification rather than being trusted.","status":"published","published":"2026-09-28T20:57:03Z","modified":"2026-11-06T20:01:25Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L","level":"low"}],"updated_at":"2026-11-06T21:07:00.111123Z"}],"nvd":[{"id":"CVE-2026-97026","description":"Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation failures (denial of service); tampered content would fail signature/digest verification rather than being trusted.","status":"published","published":"2026-09-28T21:17:19.907Z","modified":"2026-11-06T20:17:32.017Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L","level":"low","assessor":"secondary"}],"cwes":["CWE-378"],"updated_at":"2026-11-06T22:02:13.943945Z"}],"osv":[{"id":"DEBIAN-CVE-2026-97026","description":"Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation failures (denial of service); tampered content would fail signature/digest verification rather than being trusted.","status":"published","published":"2026-09-28T21:17:19.907Z","modified":"2026-11-07T09:47:26.440588325Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L","level":"low"}],"updated_at":"2026-11-07T10:14:39.995311Z"},{"id":"UBUNTU-CVE-2026-97026","description":"Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation failures (denial of service); tampered content would fail signature/digest verification rather than being trusted.","status":"published","published":"2026-09-28T21:17:00Z","modified":"2026-10-17T13:01:20.454217195Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T16:57:44.071534Z"},{"id":"MGASA-2026-0477","title":"Updated flatpak package fixes security vulnerabilities","description":"Arbitrary file deletion in root context via path traversal in deploy\ndirectory export/bin. (CVE-2026-97023)\nArbitrary write in root context via path traversal in deploy directory\nfiles/etc. (CVE-2026-97024)\nWorld-readable oci authentication token in system-helper cache path.\n(CVE-2026-97025)\nWorld-writable temporary child repositories in system-helper cache path.\n(CVE-2026-97026)\nDenial of service via unsanitized keys in exported desktop entry / d-bus\nservice files. (CVE-2026-97027)\nSandboxed app can signal unsandboxed processes in the same process\ngroup. (CVE-2026-97029)\n","status":"published","published":"2026-10-09T17:00:24Z","modified":"2026-10-09T17:15:03.305195359Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11918-1","title":"flatpak-1.18.4-1.1 on GA media","description":"These are all security issues fixed in the flatpak-1.18.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-29T00:00:00Z","modified":"2026-09-30T18:23:13.972716879Z","updated_at":"2026-11-02T16:58:40.245664Z"}]}}