CVE-2026-96279

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as /etc/shadow.

Last checked: 2026-09-29 22:54 UTC

• No exploitation evidence · CISA Coordinator (Assessed 2026-09-28 13:54 UTC)

References

• NVD: CVE-2026-96279
• Upstream Advisory

Fix Status by Distribution

Fix evidence last checked: 2026-09-28 20:14 UTC