CVE-2026-96283: Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pull

Severity: low (CVSS 3.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-27 · updated 2026-09-29
Weakness: CWE-862

Description

By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.

Affected products

Red Hat Enterprise Linux 10: all versions
Red Hat Enterprise Linux 7: all versions
Red Hat Enterprise Linux 8: all versions
Red Hat Enterprise Linux 9: all versions

References

https://access.redhat.com/security/cve/CVE-2026-96283
https://bugzilla.redhat.com/show_bug.cgi?id=2539424
https://github.com/flatpak/flatpak/security/advisories/GHSA-89xm-3m96-w3jg

Get alerted when CVE-2026-96283 or the next vulnerability affects your stack