EUVD-2026-88552Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local account on shared host
-
ExploitVictim pulls from authenticated OCI repo
-
ExecutionRead exposed auth token from other-user-visible location
-
ImpactReuse token against private OCI registry
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V5 - File Handling Temp file with insecure permissions
|
| Exploitation Conditions | Requires (1) a multi-user system where an attacker holds a separate local unprivileged account, and (2) a victim on that same host downloading a Flatpak app or runtime from an OCI repository that requires authentication - the token is only exposed during authenticated OCI pulls, so repositories without authentication and single-user machines are unaffected. Limiting factors: local access only (no remote vector), the attacker must be a co-located local user, and the window is tied to when the victim actually performs an authenticated OCI download; impact is limited to disclosure of the OCI auth token rather than direct code execution or file modification. |
| Impact | No CVSS vector, CWE, EPSS, or KEV data is provided in the input, so severity must be inferred from the advisory text alone. This is one of six vulnerabilities fixed in Flatpak 1.18.4; CVE-2026-97025 specifically is a credential-exposure flaw: when pulling apps/runtimes from an OCI repository that requires authentication, the authentication token is made visible to other local users on the same machine. This is a local confidentiality issue, not a remote or code-execution flaw - it requires the attacker to already have a local account on a multi-user system and to observe or read another user's leaked OCI token. Exploitation status is 'no public exploit identified at time of analysis' - the advisory names reporters (AISLE in cooperation with Red Hat) but references no POC and there is no KEV listing. Compared to the sibling CVEs in the same release (arbitrary file overwrite/deletion, DoS by killing the desktop environment), this token-disclosure issue is lower impact - it is a real but modest-priority credential-leak on shared systems, not a widespread critical. Absence of EPSS/KEV/CVSS is a data gap, not evidence of low risk, but the local vector and credential-only impact genuinely bound the severity to the lower end. |
| Exploit ScenarioDerived | On a shared multi-user Linux host, a low-privileged local user installs or configures a Flatpak pull from an authenticated OCI repository. Because Flatpak exposes the authentication token to other users during the download, a separate unprivileged local user reads that token and reuses it to access the private OCI registry as the victim. No public exploit code is referenced in the advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Flatpak before 1.18.4 exposes OCI authentication tokens to other local users when a victim performs an authenticated download of an app or runtime from an OCI repository, allowing a co-located attacker to capture the token and potentially misuse it. The flaw affects multi-user Linux systems and was fixed in Flatpak 1.18.4; no public exploit code or active exploitation is known at this time, and the assessed impact is limited to information disclosure (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
RemediationAI
Upgrade to Flatpak 1.18.4 or later, which includes the fix for this token exposure issue. This is the vendor-released patch and the primary remediation. On multi-user systems where immediate upgrading is not possible, avoid performing authenticated OCI repository pulls, or ensure that only trusted users have local accounts on the host-this limits exposure but may disrupt workflows that depend on private repositories. Restricting access to Flatpak’s temporary directories (e.g., /var/tmp/flatpak-cache-*) or mounting /proc with hidepid can reduce the attack surface, though these measures may not fully prevent token leakage and can affect system monitoring and application behavior. Refer to the advisory at https://seclists.org/oss-sec/2026/q3/965 for the complete list of fixed vulnerabilities and update guidance.
Affected ProductsAI
Flatpak versions before 1.18.4 on Linux systems are affected. This includes all distributions that ship Flatpak prior to the 1.18.4 release. The vulnerability specifically impacts environments where multiple users share a host and at least one user downloads from an authenticated OCI repository. No specific CPE identifiers were provided in the input. For details, see the oss-security advisory at https://seclists.org/oss-sec/2026/q3/965.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Flatpak is a Linux application sandboxing and distribution framework that can fetch apps and runtimes from OCI (Open Container Initiative) registries. When such a repository requires authentication, Flatpak obtains a bearer token; the vulnerability lies in insufficient protection of that token, making it readable by other local users-likely through world-readable temporary files, process environment variables, or command-line arguments. This is an information disclosure issue (no CWE was provided in the input, but it aligns with inadequate credential protection). The assessed CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms that a local, low-privileged attacker can obtain the token without user interaction, resulting in a low confidentiality impact. No CPE strings were provided, but the affected component is the Flatpak client on Linux.
Know when Flatpak gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Local co-located user reads another user's leaked OCI token, so AV:L/PR:L; confidentiality-only credential disclosure of a single repo token gives C:L, no integrity/availability impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
2Description PRE-NVD
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Sandbox escape in Flatpak versions prior to 1.16.4 allows applications to access arbitrary host filesystem paths and ach
Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Rated critical sever
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Rated high severity
In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the
Arbitrary file deletion in Flatpak versions prior to 1.16.4 allows sandboxed applications to delete files on the host sy
Message-filtering bypass in xdg-dbus-proxy before 0.1.9 lets a malicious or already-compromised sandboxed application -
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Rated high severity
Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows at
In Flatpak before 0.8.7, a third-party app repository could include malicious apps that contain files with inappropriate
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Rated high severity
Local privilege escalation to root in Flatpak before 1.18.1 lets an unprivileged user holding an active local session ab
Path traversal in Flatpak's app deployment handling of the exported files/etc directory allows a malicious Flatpak appli
Exploit-DB