How severe is CVE-2026-34078?

CVE-2026-34078 has a CVSS 3.x base score of 10.0, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2026-34078 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (74th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-34078?

CVE-2026-34078 affects Flatpak. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-34078?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2026-34078 have an EU (EUVD) identifier?

Yes. CVE-2026-34078 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-19970.

When was CVE-2026-34078 published?

CVE-2026-34078 was published on 2026-04-07 and last updated on 2026-07-06.

CVE-2026-34078

CVE-2026-34078 is a critical-severity vulnerability in Flatpak with a CVSS 3.x base score of 10.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-61.

Key facts

Severity: Critical (CVSS 3.x base score 10.0)
CVSS v4: 9.3
EPSS exploit prediction: 2% (74th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-19970
Weakness: CWE-61
Affected product: Flatpak
Published: 2026-04-07
Last modified: 2026-07-06

Description

Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in 1.16.4.

Frequently asked questions

What is CVE-2026-34078?: Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in 1.16.4.
How severe is CVE-2026-34078?: CVE-2026-34078 has a CVSS 3.x base score of 10.0, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2026-34078 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (74th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-34078?: CVE-2026-34078 affects Flatpak. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-34078?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2026-34078 have an EU (EUVD) identifier?: Yes. CVE-2026-34078 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-19970.
When was CVE-2026-34078 published?: CVE-2026-34078 was published on 2026-04-07 and last updated on 2026-07-06.

References

Affected products (1)

cpe:2.3:a:flatpak:flatpak:*:*:*:*:*:*:*:*

More vulnerabilities in Flatpak

CVE-2024-42472 — Critical (CVSS 10.0): Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious…
CVE-2023-28100 — Critical (CVSS 10.0): Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to…
CVE-2019-10063 — Critical (CVSS 9.0): Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions…
CVE-2021-41133 — High (CVSS 8.8): Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior…
CVE-2018-6560 — High (CVSS 8.8): In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to…
CVE-2024-32462 — High (CVSS 8.4): Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before…

All CVEs affecting Flatpak →

Other CWE-61 vulnerabilities

CVE-2025-62596 — Critical (CVSS 10.0): Youki is a container runtime written in Rust. In versions 0.5.6 and below, youki’s apparmor handling performs…
CVE-2025-62161 — Critical (CVSS 10.0): Youki is a container runtime written in Rust. In versions 0.5.6 and below, the initial validation of the source…
CVE-2025-23394 — Critical (CVSS 9.8): A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus…
CVE-2024-54661 — Critical (CVSS 9.8): readline.sh in socat before1.8.0.2 relies on the /tmp/$USER/stderr2 file.
CVE-2026-55447 — Critical (CVSS 9.6): Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, by controlling a files…
CVE-2025-68937 — Critical (CVSS 9.5): Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because…

Browse all CWE-61 vulnerabilities →