by Kastro CVE-2026-34078
flatpak flatpak — Flatpak has a complete sandbox escape leading to host file access and code execution in the host context
Description · from the CVE record
Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in 1.16.4.
Affected
ProductAffectedFixed inSource
flatpak< 1.16.4–CNA
Red Hat Enterprise Linux 10see advisory0:1.16.0-9.el10_2.1redhat-SADP
Red Hat Enterprise Linux 10.0 Extended Update Supportsee advisory0:1.16.0-5.el10_0.2redhat-SADP
Red Hat Enterprise Linux 7 Extended Lifecycle Supportsee advisory0:1.12.9-3.el7_9redhat-SADP
Red Hat Enterprise Linux 8see advisory0:1.12.9-4.el8_10redhat-SADP
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportsee advisory0:1.12.9-2.el8_4redhat-SADP
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onsee advisory0:1.12.9-2.el8_4redhat-SADP
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportsee advisory0:1.12.9-1.el8_6redhat-SADP
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-Onsee advisory0:1.12.9-1.el8_6redhat-SADP
Red Hat Enterprise Linux 8.8 Telecommunications Update Servicesee advisory0:1.12.9-1.el8_8redhat-SADP
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutionssee advisory0:1.12.9-1.el8_8redhat-SADP
Red Hat Enterprise Linux 9see advisory0:1.12.9-4.el9_8.1redhat-SADP
Scores by source
NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
GitHub_M (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
redhat-SADP (CNA)9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total