Skip to main content

Flatpak EUVDEUVD-2026-19945

| CVE-2026-34080 MEDIUM
Improper Validation of Unsafe Equivalence in Input (CWE-1289)
2026-04-07 security-advisories@github.com
Authentication Bypass Flatpak Xdg Dbus Proxy
6.8
CVSS 4.0 · Vendor: github
Share

Severity by source

Vendor (github) PRIMARY
6.8 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Apr 16, 2026 - 05:29 EUVD
0.1.7
EUVD ID Assigned
Apr 07, 2026 - 21:22 euvd
EUVD-2026-19945
Analysis Generated
Apr 07, 2026 - 21:22 vuln.today
CVE Published
Apr 07, 2026 - 21:17 nvd
MEDIUM 6.8

DescriptionCVE.org

xdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop restrictions. The proxy checks for eavesdrop=true in policy rules but fails to handle eavesdrop ='true' (with a space before the equals sign) and similar cases. Clients can intercept D-Bus messages they should not have access to. This vulnerability is fixed in 0.1.7.

AnalysisAI

Policy parser vulnerability in xdg-dbus-proxy prior to 0.1.7 allows authenticated local users to bypass eavesdrop restrictions and intercept D-Bus messages by exploiting improper whitespace handling in policy rule parsing. The proxy fails to normalize eavesdrop policy directives, permitting attackers to craft malformed policies (e.g., eavesdrop ='true' with spacing variations) that evade the eavesdrop=true access control checks. No public exploit code has been identified at time of analysis.

Technical ContextAI

xdg-dbus-proxy is a D-Bus message filtering proxy commonly used in Flatpak sandboxes to enforce security policies on inter-process communication. The vulnerability exists in the policy parsing logic, which is responsible for evaluating D-Bus access control rules before allowing message relay. The root cause is improper input validation and normalization of policy directives (CWE-1289: Improper Validation of Specified Quantity in Input). The parser checks for the exact string eavesdrop=true but does not account for whitespace variations or case sensitivity edge cases in policy rule evaluation. D-Bus messages intended to be restricted from eavesdropping become accessible when malformed policy rules pass the access control checks due to this parsing flaw.

RemediationAI

Vendor-released patch: xdg-dbus-proxy 0.1.7. Users should upgrade immediately to version 0.1.7 or later, which includes corrected policy parser logic that properly validates and normalizes eavesdrop directives. No workarounds are available for this parser vulnerability; the fix requires code-level remediation in the proxy. The upstream fix addresses whitespace handling and ensures consistent policy evaluation regardless of formatting variations in policy rules. Administrators managing Flatpak or other xdg-dbus-proxy deployments should prioritize this update, particularly in multi-user sandboxing scenarios. Additional details and patch availability are documented at https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-vjp5-hjfm-7677.

More in Flatpak

View all
CVE-2026-34078 CRITICAL
9.3 Apr 07

Sandbox escape in Flatpak versions prior to 1.16.4 allows applications to access arbitrary host filesystem paths and ach
CVE-2019-10063 CRITICAL
9.0 Mar 26

Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Rated critical sever
CVE-2021-21261 HIGH
8.8 Jan 14

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Rated high severity
CVE-2018-6560 HIGH
8.8 Feb 02

In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the
CVE-2026-34079 HIGH
8.7 Apr 07

Arbitrary file deletion in Flatpak versions prior to 1.16.4 allows sandboxed applications to delete files on the host sy
CVE-2021-21381 HIGH
8.2 Mar 11

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Rated high severity
CVE-2019-8308 HIGH
8.2 Feb 12

Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows at
CVE-2017-9780 HIGH
7.8 Jun 21

In Flatpak before 0.8.7, a third-party app repository could include malicious apps that contain files with inappropriate
CVE-2021-41133 HIGH
7.8 Oct 08

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Rated high severity
CVE-2026-39977 HIGH
7.1 Apr 09

Path traversal in flatpak-builder 1.4.5 through 1.4.7 enables arbitrary host file exfiltration through license-files man
CVE-2023-28100 MEDIUM
6.5 Mar 16

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Rated medium severi
CVE-2023-28101 MEDIUM
4.3 Mar 16

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Rated medium severi

Same weakness CWE-1289 – Improper Validation of Unsafe Equivalence in Input

View all
CVE-2024-45179 HIGH POC
7.2
CVE-2024-45308 MEDIUM POC
6.5
CVE-2022-0675 CRITICAL
9.8
CVE-2026-39821 CRITICAL
9.6
CVE-2024-8372 MEDIUM POC
4.3
CVE-2024-42219 HIGH
7.8
CVE-2026-60074 HIGH
7.5
CVE-2026-49942 HIGH
7.3

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

EUVD-2026-19945 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy