CVE-2026-96279: Flatpak OCI Registry Information Disclosure

CVE-2026-96279 Overview

CVE-2026-96279 is a hard link attack vulnerability in Flatpak that allows a malicious Open Container Initiative (OCI) registry to disclose arbitrary host file contents. When a user installs or updates a Flatpak application from an OCI remote, the registry can hardlink files on the host system into the extraction directory. The attacker then reads those files through the extracted application bundle.

For system-wide installations running as root, the attack exposes sensitive files including /etc/shadow, SSH host keys, and other credential stores. The flaw is tracked under CWE-59: Improper Link Resolution Before File Access.

Critical Impact
A malicious OCI remote can read arbitrary files from the host, including /etc/shadow on system-wide installs executed as root.

Affected Products

Flatpak application distribution framework (versions supporting OCI remotes)
Red Hat Enterprise Linux and Fedora systems using Flatpak with OCI registry sources
Any Linux distribution installing Flatpak applications from OCI-based remotes

Discovery Timeline

2026-09-27 - CVE-2026-96279 published to the National Vulnerability Database (NVD)
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-96279

Vulnerability Analysis

Flatpak supports installing applications from OCI registries in addition to its native OSTree-based remotes. During installation or update, the client fetches and extracts layer archives into a staging directory. The extraction routine fails to validate that hard link entries within the archive point only to files already contained in the archive itself.

A crafted OCI image can include hard link entries whose targets resolve to absolute paths on the host filesystem. When the Flatpak client processes these entries, the operating system creates hard links from the extraction directory to the attacker-chosen host files. The attacker-controlled application bundle then has read access to the linked file contents.

System-wide installs run through flatpak-system-helper as root, allowing links to files only readable by root. User installs are constrained by the invoking user's permissions but can still expose user secrets such as SSH keys and browser credential databases.

Root Cause

The root cause is improper link resolution before file access ([CWE-59]). The OCI layer extraction logic trusts hard link target paths supplied by the remote without verifying they reference entries inside the extraction tree. This absent validation turns archive processing into an arbitrary file disclosure primitive.

Attack Vector

Exploitation requires a user to install or update a Flatpak application from an attacker-controlled OCI remote. The attacker publishes a malicious container image whose layers include hard link records targeting sensitive host paths. User interaction is required, consistent with the UI:R component of the CVSS vector. No prior authentication to the victim system is needed.

See the GitHub Security Advisory GHSA-9rww-v4mm-x4jg for coordinated disclosure details and the Red Hat CVE-2026-96279 Advisory for distribution impact.

Detection Methods for CVE-2026-96279

Indicators of Compromise

Unexpected hard links inside Flatpak extraction directories under /var/lib/flatpak/ or ~/.local/share/flatpak/ whose inodes match files in /etc, /root, or user home directories
Flatpak installation or update operations referencing unfamiliar OCI remote URLs
Access events on sensitive files such as /etc/shadow originating from flatpak or flatpak-system-helper processes

Detection Strategies

Audit configured Flatpak remotes with flatpak remotes --show-details and flag any OCI type remotes from untrusted sources
Use filesystem auditing (auditd watches on /etc/shadow, /root/.ssh/) to detect reads performed by Flatpak helper processes
Review package manager and Flatpak installation logs for recent installs or updates from OCI remotes preceding suspicious file access

Monitoring Recommendations

Monitor process execution of flatpak install and flatpak update with command-line arguments captured for later correlation
Alert on hard link creation events where source paths lie outside the Flatpak staging tree
Track outbound network connections from Flatpak clients to non-approved OCI registry endpoints

How to Mitigate CVE-2026-96279

Immediate Actions Required

Update Flatpak to the fixed version provided by your Linux distribution as soon as vendor packages are available
Remove or disable any OCI-type Flatpak remotes that are not operated by a trusted first-party vendor
Avoid running flatpak install or flatpak update as root until patched packages are deployed

Patch Information

Patched Flatpak packages are being distributed through upstream and downstream channels. Consult the Red Hat CVE-2026-96279 Advisory and Red Hat Bug Report #2539417 for the fixed package versions on Red Hat Enterprise Linux and Fedora. Users on other distributions should apply the upstream fix referenced in GHSA-9rww-v4mm-x4jg.

Workarounds

Restrict Flatpak installations to the Flathub OSTree remote and avoid OCI-based remotes until patched
Prefer per-user installs over system-wide installs to limit disclosure scope to the invoking user's accessible files
Remove untrusted remotes with flatpak remote-delete <name> and verify remaining remotes with flatpak remotes

bash

# List configured remotes and remove untrusted OCI sources
flatpak remotes --show-details
flatpak remote-delete untrusted-oci-remote

# Prefer per-user installations to limit privilege scope
flatpak --user install flathub <application-id>