CVE-2026-96284: Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci symlink following

Severity: low (CVSS 2.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-27 · updated 2026-09-29
Weakness: CWE-59

Description

A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control.

Affected products

Red Hat Enterprise Linux 10: all versions
Red Hat Enterprise Linux 7: all versions
Red Hat Enterprise Linux 8: all versions
Red Hat Enterprise Linux 9: all versions

References

https://access.redhat.com/security/cve/CVE-2026-96284
https://bugzilla.redhat.com/show_bug.cgi?id=2539423
https://github.com/flatpak/flatpak/security/advisories/GHSA-2fxp-43j9-pwvc

Get alerted when CVE-2026-96284 or the next vulnerability affects your stack