Critical severity · published Apr 7, 2026
CVE-2026-34078
Flatpak has a complete sandbox escape leading to host file access and code execution in the host context
10.0
CVSS
1.7%
EPSS
No
On KEV
Description
Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in 1.16.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
flatpak · flatpak
< 1.16.4 · source: vendor, NVD
RH
Red Hat Enterprise Linux 10 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 7 Extended Lifecycle Support · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 8 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 8.8 Telecommunications Update Service · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 9 · Red Hat
All versions, or not specified · source: CISA
In the news
VulnerabilityCritical
Flatpak 1.16.4 fixes sandbox escape and three other security flaws
Flatpak, a Linux application sandboxing and distribution framework, released version 1.16.4, patching four security vulnerabilities. The most severe fix addresses a complete sandbox escape that leads to host file access and code execution in the host context, tracked as CVE-2026-34078. File system exposure Two additional fixes address file system exposure on the host. CVE-2026-34079 prevents arbitrary file deletion on the host filesystem. GHSA-2fxp-43j9-pwvc prevents arbitrary read-access to files in the system-helper context. The fourth fix, … More →
The post Flatpak 1.16.4 fixes sandbox escape and three other security flaws appeared first on Help Net Security .
Apr 8, 2026·Help Net Security
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-34078
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-34078
Vendor Advisory
https://github.com/flatpak/flatpak/security/advisories/GHSA-cc2q-qc34-jprg
Mailing List
http://www.openwall.com/lists/oss-security/2026/04/09/8
Mailing List
http://www.openwall.com/lists/oss-security/2026/04/10/14
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:21755
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:21756
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:21757
More from flatpak
10.0
CVE-2024-42472
Flatpak is a Linux application sandboxing and distribution framework
9.0
CVE-2019-10063
Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass
8.8
CVE-2021-21261
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux
8.8
CVE-2018-6560
In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because…
8.6
CVE-2021-43860
Flatpak is a Linux application sandboxing and distribution framework