CVE-2026-90616: Flatpak Privilege Escalation Vulnerability

CVE-2026-90616 Overview

CVE-2026-90616 is a symlink-following vulnerability in Flatpak before version 1.18.1 that allows a malicious sandboxed application to escape confinement. The flaw resides in how Flatpak creates per-app data directories such as /var/cache, /var/data, /var/config, and /var/tmp inside every sandbox at launch. Because some path components are attacker-controlled and symlink protection is missing, a crafted symlink can redirect these directories to arbitrary host locations. Flatpak then bind-mounts those redirected paths into the sandbox through bwrap --bind, granting arbitrary read and write access to the host filesystem. This access can be escalated to arbitrary code execution outside the sandbox. It is tracked under [CWE-61: UNIX Symbolic Link (Symlink) Following].

Critical Impact
A malicious Flatpak app can read and write arbitrary host files, then escalate to arbitrary code execution on the host system.

Affected Products

Flatpak versions prior to 1.18.1
Applications packaged and executed through vulnerable Flatpak runtimes
Linux distributions shipping affected Flatpak builds

Discovery Timeline

2026-09-12 - CVE-2026-90616 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90616

Vulnerability Analysis

Flatpak isolates applications using Bubblewrap (bwrap), which sets up mount namespaces before executing the sandboxed process. During sandbox construction, Flatpak provisions per-application data directories under paths that include attacker-controlled components, for example /home/user/.var/app/APP_ID/cache/tmp. Flatpak passes these paths directly to bwrap --bind SRC DST. The kernel resolves the SRC path and follows any symlinks it encounters. If the attacker has replaced a component such as tmp with a symlink pointing at a sensitive host location, the resolved target becomes bind-mounted into the sandbox. The sandboxed process then reads and writes that host location with the privileges of the invoking user. This is a separate defect from CVE-2026-76925, which also affected Flatpak sandbox integrity.

Root Cause

The root cause is missing symlink protection when Flatpak creates and passes app data directories to bwrap. Path components under the application's private data tree are treated as trusted, but a prior sandboxed run can plant symlinks that survive across launches. Because bwrap relies on the kernel's default symlink-following behavior when binding sources, the redirection is honored without validation.

Attack Vector

Exploitation requires local execution of a malicious Flatpak application. The app plants a symlink inside its own .var/app/APP_ID/ tree, then triggers a new sandbox launch. On the next launch, the redirected bind mount exposes the host target inside the sandbox, enabling arbitrary read and write. Escalation to code execution follows by writing to user-owned files such as shell startup scripts or systemd user units.

See the GitHub Security Advisory and the OpenWall OSS Security Update for full technical details.

Detection Methods for CVE-2026-90616

Indicators of Compromise

Symlinks inside ~/.var/app/*/cache, ~/.var/app/*/data, ~/.var/app/*/config, or ~/.var/app/*/tmp whose targets resolve outside the application's private tree
Unexpected modifications to user-owned autostart or shell initialization files such as ~/.bashrc, ~/.profile, or ~/.config/autostart/*.desktop shortly after a Flatpak launch
bwrap processes performing bind operations whose resolved source paths lie outside ~/.var/app/

Detection Strategies

Inventory installed Flatpak versions across Linux endpoints and flag any host running a version earlier than 1.18.1
Audit the contents of ~/.var/app/ for symbolic links using find ~/.var/app -type l and review any targets that leave the app-scoped directory
Monitor process telemetry for flatpak run invocations followed by writes to sensitive user configuration paths

Monitoring Recommendations

Enable Linux auditd rules on symlink, symlinkat, and mount syscalls originating from bwrap or Flatpak helper processes
Ship endpoint telemetry to a centralized data lake and alert on new symlinks under ~/.var/app/ that reference paths outside the user's home directory
Track installation and update events for Flatpak packages to confirm patched versions are deployed

How to Mitigate CVE-2026-90616

Immediate Actions Required

Upgrade Flatpak to version 1.18.1 or later on every affected Linux host
Restrict Flatpak application installation to trusted remotes such as Flathub verified publishers
Remove or quarantine any Flatpak applications from untrusted sources pending investigation
Inspect ~/.var/app/ on affected user accounts and remove symlinks that redirect app data directories to host locations

Patch Information

The vulnerability is fixed in Flatpak 1.18.1. The upstream patch adds symlink protection when creating and binding per-app data directories so that bwrap no longer follows attacker-planted symlinks during sandbox setup. Consult the GitHub Security Advisory GHSA-8688-9x26-hhxj for the fix commits and the OpenWall disclosure for coordinated distribution updates.

Workarounds

Avoid launching Flatpak applications from untrusted publishers until the patch is deployed
Remove per-application state under ~/.var/app/APP_ID/ for suspect apps to clear any planted symlinks before the next launch
Where feasible, run untrusted applications inside a dedicated, non-privileged user account to limit the blast radius of host file access

bash

# Verify installed Flatpak version and upgrade
flatpak --version
sudo apt update && sudo apt install --only-upgrade flatpak   # Debian/Ubuntu
sudo dnf upgrade flatpak                                     # Fedora/RHEL

# Audit for suspicious symlinks in per-app data directories
find ~/.var/app -type l -printf '%p -> %l\n' | \
  awk '$3 !~ "^'"$HOME"'/.var/app/"'