CVE-2026-34078: Flatpak is a Linux application sandboxing and distribution framework

Q: How do I fix CVE-2026-34078?

flatpak: upgrade to newer than 1.16.3. Exact commands for each OS are on this page.

Q: Is CVE-2026-34078 being exploited?

CVE-2026-34078 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2026-34078 affect?

CVE-2026-34078 affects flatpak. Severity is critical (CVSS 10.0). Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the r

Q: How urgent is CVE-2026-34078?

Priority 67/100. Critical severity; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action; On your watchlist

This week

CRITICAL 10.0REMOTEWATCHLISTUPGRADE

CVE-2026-34078 is a critical-severity flaw (CVSS 10.0) affecting flatpak. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in 1.16.4.

Why this priority

Critical severity
CISA SSVC: automatable with total technical impact
Remotely exploitable, no login, no user action
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	10.0 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	1.7% (top 23%)
CISA exploited list	No
Weakness	CWE-61, CWE-59
Published	2026-04-07
Last modified	2026-07-24

Publisher (CNA): GitHub, Inc. · Vendor: flatpak

Last updated 2026-07-24 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-04-07 22:16 UTCPublished CVE record published
2026-07-24 22:10 UTCUpdated Record last modified

flatpak flatpak UPGRADE

Affected: <= 1.16.3

Fixed in: newer than 1.16.3

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy flatpak || rpm -q flatpak || flatpak --version

2. UPGRADE to newer than 1.16.3 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade flatpak

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade flatpak

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Exact fixes by distribution

Fedora 46 · python-googleapis-common-protos · FIXED · 1.75.5-1.fc46~bootstrap · FEDORA-2026-d911c4c4e6 · source

sudo dnf upgrade --advisory=FEDORA-2026-d911c4c4e6

Fedora ELN · see advisory · FIXED · FEDORA-2026-e3987c278f · source

sudo dnf upgrade --advisory=FEDORA-2026-e3987c278f

Debian 12 · flatpak · FIXED · 1.14.10-1~deb12u2

sudo apt update && sudo apt install --only-upgrade flatpak dpkg --compare-versions "$(dpkg-query -W -f='${Version}' flatpak)" ge "1.14.10-1~deb12u2" && echo PATCHED || echo STILL-VULNERABLE

Debian 13 · flatpak · FIXED · 1.16.6-1~deb13u1

sudo apt update && sudo apt install --only-upgrade flatpak dpkg --compare-versions "$(dpkg-query -W -f='${Version}' flatpak)" ge "1.16.6-1~deb13u1" && echo PATCHED || echo STILL-VULNERABLE

RHEL 10 · flatpak · FIXED · flatpak-1.16.0-9.el10_2.1

sudo dnf upgrade --advisory=RHSA-2026:21757 rpm -q flatpak

RHEL 10.0 Extended Update Support · flatpak · FIXED · flatpak-1.16.0-5.el10_0.2

sudo dnf upgrade --advisory=RHSA-2026:23420 rpm -q flatpak

RHEL 7 Extended Lifecycle Support · flatpak · FIXED · flatpak-1.12.9-3.el7_9

sudo dnf upgrade --advisory=RHSA-2026:35843 rpm -q flatpak

RHEL 8 · flatpak · FIXED · flatpak-1.12.9-4.el8_10

sudo dnf upgrade --advisory=RHSA-2026:21756 rpm -q flatpak

RHEL 8.4 Advanced Mission Critical Update Support · flatpak · FIXED · flatpak-1.12.9-2.el8_4

sudo dnf upgrade --advisory=RHSA-2026:30901 rpm -q flatpak

Alpine 3.23 · flatpak · FIXED · flatpak-1.16.4-r0

apk add --upgrade flatpak apk info -v flatpak

Alpine 3.24 · flatpak · FIXED · flatpak-1.16.4-r0

apk add --upgrade flatpak apk info -v flatpak

Amazon Linux 2023 · see advisory · FIXED · ALAS2023-2026-1601 · source

sudo dnf update --advisory=ALAS2023-2026-1601

Amazon Linux 2 · see advisory · FIXED · ALAS2-2026-3261 · source

sudo yum update --advisory=ALAS2-2026-3261

Advisories and coverage

Official advisories

AlmaLinux Errata: [ALSA-2026:21755] Important: flatpak security update 2026-05-29

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-34078?

flatpak: upgrade to newer than 1.16.3. Exact commands for each OS are on this page.

Is CVE-2026-34078 being exploited?

CVE-2026-34078 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-34078 affect?

CVE-2026-34078 affects flatpak. Severity is critical (CVSS 10.0). Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the r

How urgent is CVE-2026-34078?

Priority 67/100. Critical severity; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action; On your watchlist

Related CVEs

CVE-2026-34079 HIGH 7.5 UPGRADE Flatpak is a Linux application sandboxing and distribution framework

References

← Back to latest CVEs