CVE-2026-94422: xdg-dbus-proxy RCE Vulnerability

CVE-2026-94422 Overview

CVE-2026-94422 is a message filtering bypass in xdg-dbus-proxy versions before 0.1.9. The proxy incorrectly treats non-reply D-Bus messages that carry a reply_serial field as legitimate replies. An attacker controlling a sandboxed Flatpak application can craft messages that bypass the proxy's filter rules on the D-Bus session bus. Successful exploitation permits arbitrary code execution outside the sandbox boundary. The flaw is tracked under [CWE-290: Authentication Bypass by Spoofing]. xdg-dbus-proxy is maintained by the Flatpak project but is also consumed by other sandboxing frameworks such as Firejail, broadening the exposure beyond Flatpak alone.

Critical Impact
A compromised Flatpak or Firejail-sandboxed application can forge D-Bus messages that pass through the proxy filter and execute code on the host outside the sandbox.

Affected Products

xdg-dbus-proxy versions prior to 0.1.9
Flatpak deployments relying on xdg-dbus-proxy for D-Bus session bus filtering
Firejail and other sandbox frameworks that embed xdg-dbus-proxy

Discovery Timeline

2026-09-23 - Vulnerability disclosed on the OpenWall OSS-Security mailing list
2026-10-02 - CVE-2026-94422 published to NVD
2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-94422

Vulnerability Analysis

xdg-dbus-proxy sits between a sandboxed application and the host D-Bus session bus. It enforces an allow/deny policy on method calls, signals, and replies so that the sandbox cannot invoke arbitrary services. The proxy tracks outbound method calls and expects matching replies to carry the original serial number in a reply_serial header field.

The filter logic assumed that only messages of type METHOD_RETURN or ERROR would populate reply_serial. In practice, the D-Bus wire protocol permits any message type to include that header. By attaching a reply_serial matching a pending call, a sandboxed client can mark an arbitrary METHOD_CALL or SIGNAL as if it were a legitimate reply and bypass policy checks that would otherwise block it.

Root Cause

The parser exposed a boolean has_reply_serial flag that the proxy conflated with the message being a reply. The patch removes that assumption and restricts reply-serial handling to actual reply message types, closing the type-confusion in the filtering state machine. Review the GitHub Security Advisory GHSA-2cgv-pwcq-wvpq for the full write-up.

Attack Vector

Exploitation requires a malicious or compromised application already running inside the Flatpak or Firejail sandbox. The attacker sends crafted D-Bus traffic through the proxy to invoke restricted services such as org.freedesktop.Flatpak or portal interfaces that can spawn host processes. User interaction is required to run the hostile app, but no additional privileges are needed.

   const char *destination;
   const char *sender;
   const char *signature;
-  gboolean    has_reply_serial;
   guint32     reply_serial;
   guint32     unix_fds;
 } Header;
// Source: https://github.com/flatpak/xdg-dbus-proxy/commit/e5702fca4dba9600721921fbca2dbc39dc5ca400
// The patch removes the has_reply_serial flag so the proxy no longer treats
// any message with a reply_serial as a reply.

Detection Methods for CVE-2026-94422

Indicators of Compromise

Flatpak or Firejail child processes spawning unexpected host binaries such as shells or package managers
D-Bus method calls to org.freedesktop.Flatpak.Development or portal Spawn interfaces originating from sandboxed apps that should not have that permission
xdg-dbus-proxy processes logging policy decisions that permit traffic outside the configured allowlist

Detection Strategies

Enable verbose logging in xdg-dbus-proxy with --log and audit METHOD_CALL messages that carry a non-zero reply_serial
Compare installed xdg-dbus-proxy versions against 0.1.9 across Linux fleet inventory
Hunt for host-side process creation chains where the parent is a Flatpak sandbox helper (bwrap, flatpak-bwrap)

Monitoring Recommendations

Forward Linux execve telemetry and D-Bus audit logs to a central analytics tier to correlate sandbox-origin activity with host execution
Alert on new or unusual D-Bus service names being invoked by sandboxed desktop applications
Track package manager events that upgrade xdg-dbus-proxy, flatpak, or firejail to confirm patch deployment

How to Mitigate CVE-2026-94422

Immediate Actions Required

Upgrade xdg-dbus-proxy to version 0.1.9 or later on every host that runs Flatpak or Firejail
Rebuild and redistribute downstream packages that vendor xdg-dbus-proxy as a static dependency
Audit installed Flatpak applications and remove any from untrusted sources until patching is complete

Patch Information

Upstream fixes are available in the Flatpak repository: commit e5702fca removes the has_reply_serial assumption, commit fc027f75 clarifies message direction tracking, and commit e4465a0d completes the hardening. Distribution-specific updates are tracked in the Red Hat CVE record and Red Hat Bug #2542235.

Workarounds

Restrict Flatpak application installation to trusted remotes such as the verified Flathub channel
Tighten per-application D-Bus policy with flatpak override --nosocket=session-bus for applications that do not require session bus access
Disable or uninstall Firejail profiles that rely on xdg-dbus-proxy filtering until the patched version is deployed

bash

# Verify the installed proxy version and remove session bus access for an app
xdg-dbus-proxy --version
flatpak override --user --nosocket=session-bus org.example.UntrustedApp