CVE-2026-96284: Flatpak System Helper Path Traversal Flaw

CVE-2026-96284 Overview

CVE-2026-96284 is a local information disclosure vulnerability in the Flatpak flatpak-system-helper component. The flaw arises when a system Open Container Initiative (OCI) repository is configured. The OCI code paths in the system helper follow symbolic links when importing OCI images that originate from user-controlled locations. A local, authenticated user can abuse this behavior to read files accessible to the flatpak-system-helper context.

The weakness is tracked under CWE-59: Improper Link Resolution Before File Access. Exploitation requires local access, low privileges, and a specific system configuration.

Critical Impact
Local users can obtain read access to files available to the flatpak-system-helper privileged process when a system OCI repository is configured.

Affected Products

Flatpak application sandboxing and distribution framework
Linux distributions packaging Flatpak with the flatpak-system-helper component
Systems configured with a system-wide OCI repository backend

Discovery Timeline

2026-09-27 - CVE CVE-2026-96284 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-96284

Vulnerability Analysis

Flatpak distributes applications as sandboxed bundles and uses flatpak-system-helper, a privileged D-Bus service, to perform system-wide installation and update operations. When a system OCI repository is configured, the helper imports container images laid out on disk. The import routine traverses files that the invoking user controls.

The issue is that symlink resolution occurs within the privileged helper context rather than being constrained to the user-controlled image tree. By placing a symbolic link inside an OCI image directory that targets an arbitrary file path, a local user can trick the helper into opening and reading that target during import.

Content accessible to flatpak-system-helper can then be reflected back to the attacker through import side effects or stored objects. The impact is limited to confidentiality, consistent with the integrity and availability properties being unaffected.

Root Cause

The root cause is a classic [CWE-59] link-following flaw. The OCI import code path in flatpak-system-helper opens files by name without using symlink-safe resolution primitives such as openat2() with RESOLVE_NO_SYMLINKS or equivalent sandboxing. Because the input tree is user-writable but the opening process is privileged, following a symlink crosses a trust boundary.

Attack Vector

Exploitation requires a local account on a system where a system OCI repository has been configured in Flatpak. The attacker stages an OCI image directory under their control and plants symlinks pointing to target files readable by the helper. They then invoke the system helper to import the image, causing the privileged process to dereference the symlinks and expose file contents. Attack complexity is high because it depends on configuration and timing conditions.

No verified exploit code is published. Refer to the GitHub Flatpak Security Advisory GHSA-2fxp-43j9-pwvc for authoritative technical detail.

Detection Methods for CVE-2026-96284

Indicators of Compromise

Unexpected symbolic links inside directories used as OCI image sources on multi-user systems.
flatpak-system-helper process accessing files outside expected OCI import paths such as /etc/shadow, SSH host keys, or other sensitive files.
D-Bus activations of org.freedesktop.Flatpak.SystemHelper tied to non-administrative local users importing OCI content.

Detection Strategies

Audit filesystem activity of the flatpak-system-helper binary using Linux audit rules on open, openat, and readlink syscalls.
Correlate D-Bus method calls to SystemHelper with subsequent file reads outside the user's OCI image staging directory.
Review Flatpak system repository configurations to identify where OCI backends are enabled and which users can submit images.

Monitoring Recommendations

Enable auditd rules for the flatpak-system-helper executable and alert on reads of sensitive files it would not normally touch.
Monitor for creation of symbolic links inside directories used as OCI import sources by non-root users.
Centralize Linux endpoint telemetry so symlink-related anomalies in privileged helper processes are retained for investigation.

How to Mitigate CVE-2026-96284

Immediate Actions Required

Apply the Flatpak security update referenced in the Red Hat CVE-2026-96284 Advisory as soon as distribution packages are available.
Inventory systems where a system OCI repository is configured and treat them as higher priority for patching.
Restrict which local users can trigger system-wide Flatpak operations through Polkit policy review.

Patch Information

Upstream fixes are coordinated through the Flatpak project. Consult the GitHub Flatpak Security Advisory GHSA-2fxp-43j9-pwvc for fixed versions, and track distribution updates via the Red Hat Bug Report #2539423. Install vendor-provided packages rather than building from source to ensure Polkit rules and helper binaries are updated together.

Workarounds

Avoid configuring system-wide OCI repositories until the patch is applied; prefer standard OSTree-based Flatpak remotes.
Limit Flatpak system-helper access to trusted administrators via Polkit configuration restricting org.freedesktop.Flatpak.SystemHelper actions.
Store any user-supplied OCI image content on filesystems where symlink creation by untrusted users is not permitted.

bash

# Configuration example: list and review system Flatpak remotes
flatpak remotes --system --show-details

# Remove a system OCI remote as a temporary mitigation
sudo flatpak remote-delete --system <oci-remote-name>

# Restrict SystemHelper actions via Polkit (example rule)
# /etc/polkit-1/rules.d/10-flatpak-restrict.rules
polkit.addRule(function(action, subject) {
    if (action.id.indexOf("org.freedesktop.Flatpak") == 0 &&
        !subject.isInGroup("wheel")) {
        return polkit.Result.NO;
    }
});