Critical 9.3Published Apr 7, 2026

CVE-2026-34078Flatpak has a complete sandbox escape leading to host file access and code execution in the host context

Updated under an hour ago (Oct 27, 2026, 7:10 AM ET)

Does this affect you?

It affects flatpak and 8 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for flatpak

Exploited in the last 30 days

Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in 1.16.4.

CVSS: 9.3 CRITICAL (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness (CWE): CWE-61, CWE-59
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Modified
Record last updated: Jul 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

flatpak flatpak flatpak:flatpak (from the name)	before 1.16.4	CNA record
Red Hat Red Hat Enterprise Linux 10 redhat:enterprise_linux	from 0:1.16.0-9.el10_2.1 not affected	CISA ADP
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support redhat:enterprise_linux_eus	from 0:1.16.0-5.el10_0.2 not affected	CISA ADP
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support redhat:rhel_els	from 0:1.12.9-3.el7_9 not affected	CISA ADP
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support redhat:rhel_aus	from 0:1.12.9-2.el8_4 not affected	CISA ADP
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On redhat:rhel_eus_long_life	from 0:1.12.9-2.el8_4 not affected	CISA ADP
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service redhat:rhel_tus	from 0:1.12.9-1.el8_8 not affected	CISA ADP
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions redhat:rhel_e4s	from 0:1.12.9-1.el8_8 not affected	CISA ADP
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support redhat:rhel_eus	from 0:1.12.9-4.el9_6.1 not affected	CISA ADP
flatpak flatpak flatpak:flatpak	through 1.16.3	NVD

References

References

https://github.com/flatpak/flatpak/security/advisories/GHSA-cc2q-qc34-jprg	x-refsource-confirm, vendor-advisory
http://www.openwall.com/lists/oss-security/2026/04/09/8	mailing-list, third-party-advisory
http://www.openwall.com/lists/oss-security/2026/04/10/14	mailing-list, third-party-advisory
https://access.redhat.com/errata/RHSA-2026:21755
https://access.redhat.com/errata/RHSA-2026:21756
https://access.redhat.com/errata/RHSA-2026:21757
https://access.redhat.com/errata/RHSA-2026:23417
https://access.redhat.com/errata/RHSA-2026:23418
https://access.redhat.com/errata/RHSA-2026:23419
https://access.redhat.com/errata/RHSA-2026:23420
1–10 of 17

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.