CVE-2026-97026: Flatpak Temporary Directory DOS Vulnerability

CVE-2026-97026 Overview

Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). The insecure permissions expose these directories to any local user during the installation of applications or runtimes. On multi-user systems configured with a permissive umask, other local accounts can read or modify the temporary staging directory. The practical effect is limited to installation failure because tampered content fails signature and digest verification before Flatpak trusts it. The weakness is classified as [CWE-378] Creation of Temporary File With Insecure Permissions.

Critical Impact
Local users on multi-user Linux systems can tamper with Flatpak's temporary repository directories, causing installation failures. Signature verification prevents malicious content from being trusted.

Affected Products

Flatpak (application sandboxing and distribution framework for Linux)
Linux distributions shipping vulnerable Flatpak builds on multi-user systems
Environments configured with a permissive umask where multiple local accounts share a host

Discovery Timeline

2026-09-28 - CVE CVE-2026-97026 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-97026

Vulnerability Analysis

Flatpak uses a per-user cache directory to stage repository content while installing applications or runtimes. During this process, Flatpak creates child directories inside the cache with mode 0777, granting read, write, and execute access to every local user on the system.

When the invoking user's umask does not restrict permissions on newly created files, other local accounts can enumerate the staging directory and modify files inside it. The attack requires local access, low privileges, and user interaction because the target user must trigger a Flatpak install or update.

The impact is limited to availability. Flatpak validates downloaded objects against OSTree signatures and content digests before use. Tampered files fail these checks, aborting the transaction rather than executing attacker-controlled payloads. The result is a denial-of-service condition against Flatpak installations.

Root Cause

The root cause is the explicit use of world-writable permissions when creating temporary child directories under the user cache. Flatpak should apply restrictive permissions such as 0700 on directories it owns, or rely on mkdtemp-style APIs that enforce private modes independent of the caller's umask. The current behavior places sensitive intermediate state in a location where unrelated local users can interfere.

Attack Vector

A local unprivileged user monitors the Flatpak cache directory for the creation of a staging subdirectory belonging to another user. When the target initiates an installation, the attacker writes to or removes files inside the 0777 directory. Flatpak subsequently fails the signature or digest check and aborts the install. See the GitHub Flatpak Security Advisory for the maintainer analysis.

Detection Methods for CVE-2026-97026

Indicators of Compromise

Presence of directories with mode 0777 beneath the per-user Flatpak cache path (typically ~/.cache/flatpak/) owned by another user account.
Repeated Flatpak install or update failures citing OSTree signature or digest verification errors on a multi-user host.
Unexpected file modifications inside Flatpak temporary repository staging directories during active install operations.

Detection Strategies

Audit filesystem permissions on user cache directories using periodic scans for world-writable directories owned by interactive user accounts.
Collect and review Flatpak client logs for aborted transactions and verification failures that correlate with concurrent activity from other local users.
Enable Linux audit rules (auditd) on the Flatpak cache path to record open, write, and unlink operations initiated by users other than the directory owner.

Monitoring Recommendations

Forward auditd and syslog events from shared Linux hosts to a centralized logging platform for correlation across user sessions.
Alert on Flatpak process exits that reference signature or checksum mismatch errors, particularly on multi-user workstations and terminal servers.
Track creation of 0777 directories inside user home directories as a general hygiene control, not only for Flatpak.

How to Mitigate CVE-2026-97026

Immediate Actions Required

Update Flatpak to the fixed release identified in the Red Hat CVE Advisory once available for your distribution.
Restrict shell access on multi-user systems so that untrusted local users cannot observe or modify other users' cache directories.
Enforce a restrictive default umask such as 0077 for interactive users to reduce exposure of newly created files.

Patch Information

Refer to the GitHub Flatpak Security Advisory GHSA-r9w3-qx54-qvc8 and the Red Hat Bug Report for the specific commits and package updates that correct the permissions applied to temporary child repository directories. Distribution maintainers will backport the fix into supported Flatpak packages.

Workarounds

Avoid running Flatpak install or update operations concurrently with untrusted local users logged in to the same host.
Set a restrictive umask (for example, umask 0077) in shell initialization files so files created by Flatpak inherit private permissions where possible.
Isolate development or shared workstations by giving each user a dedicated host or container instead of relying on shared multi-user Linux systems for Flatpak workflows.

bash

# Configuration example
# Enforce a restrictive umask for interactive shells
echo 'umask 0077' | sudo tee -a /etc/profile.d/restrictive-umask.sh
sudo chmod 0644 /etc/profile.d/restrictive-umask.sh

# Audit existing Flatpak cache directories for world-writable permissions
find ~/.cache/flatpak -type d -perm -0002 -ls