Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in 1.16.4.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:25381 advisory.

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

    Security Fix(es):

    * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options     (CVE-2026-34078)

    * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation     (CVE-2026-34079)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:25068 advisory.

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

    Security Fix(es):

    * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options     (CVE-2026-34078)

    * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation     (CVE-2026-34079)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:23420 advisory.

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

    Security Fix(es):

    * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options     (CVE-2026-34078)

    * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation     (CVE-2026-34079)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:23418 advisory.

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

    Security Fix(es):

    * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options     (CVE-2026-34078)

    * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation     (CVE-2026-34079)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:23417 advisory.

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

    Security Fix(es):

    * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options     (CVE-2026-34078)

    * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation     (CVE-2026-34079)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:23419 advisory.

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

    Security Fix(es):

    * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options     (CVE-2026-34078)

    * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation     (CVE-2026-34079)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:21755 advisory.

    * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options     (CVE-2026-34078)

    * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation     (CVE-2026-34079)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:21757 advisory.

    * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options     (CVE-2026-34078)

    * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation     (CVE-2026-34079)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-753:02 advisory.

    * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options     (CVE-2026-34078)
      * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation     (CVE-2026-34079)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:21757 advisory.

    * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options     (CVE-2026-34078)
      * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation     (CVE-2026-34079)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:21755 advisory.

    * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options     (CVE-2026-34078)
      * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation     (CVE-2026-34079)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:21756 advisory.

    * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options     (CVE-2026-34078)

    * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation     (CVE-2026-34079)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-21756 advisory.

    [1.12.9-4]
    - Fix arbitrary code execution via crafted symlinks in sandbox-expose options       Resolves: RHEL-165633
    - Fix arbitrary file deletion on host via improper cache file path validation       Resolves: RHEL-170160

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:21756 advisory.

    * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options     (CVE-2026-34078)
      * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation     (CVE-2026-34079)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:21756 advisory.

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

    Security Fix(es):

    * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options     (CVE-2026-34078)

    * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation     (CVE-2026-34079)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:21755 advisory.

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

    Security Fix(es):

    * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options     (CVE-2026-34078)

    * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation     (CVE-2026-34079)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:21757 advisory.

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

    Security Fix(es):

    * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options     (CVE-2026-34078)

    * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation     (CVE-2026-34079)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1713-1 advisory.

    - CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options (bsc#1261769).
    - CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation (bsc#1261770).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1601 advisory.

    A complete sandbox escape vulnerability exists in Flatpak before 1.16.4. The Flatpak portal accepts paths     in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak     run mounts the resolved host path in the sandbox, giving apps access to all host files and enabling code     execution in the host context. (CVE-2026-34078)

    Arbitrary file deletion on the host filesystem in Flatpak before 1.16.4. The caching for ld.so removes     outdated cache files without properly checking that the app-controlled path to the outdated cache is in     the cache directory, allowing Flatpak applications to delete arbitrary files on the host. (CVE-2026-34079)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of flatpak installed on the remote host is prior to 1.0.9-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3261 advisory.

    A complete sandbox escape vulnerability exists in Flatpak before 1.16.4. The Flatpak portal accepts paths     in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak     run mounts the resolved host path in the sandbox, giving apps access to all host files and enabling code     execution in the host context. (CVE-2026-34078)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2a3e305ac4 advisory.

    Update to 1.16.6

    Fixes for CVE-2026-34078, CVE-2026-34079, GHSA-2fxp-43j9-pwvc and GHSA-89xm-3m96-w3jg


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1600-1 advisory.

    - CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options (bsc#1261769).
    - CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation (bsc#1261770).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1541-1 advisory.

    - CVE-2026-34078: improper processing of app-controlled symlinks by sandbox-expose can lead to sandbox     escape, host       file access and code execution in the host context (bsc#1261769).
    - CVE-2026-34079: improper removal of outdated cache files allows for arbitrary file deletion on the host     filesystem       (bsc#1261770).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6223 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6223-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     April 22, 2026                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : flatpak     CVE ID         : CVE-2026-34078 CVE-2026-34079

    Multiple security vulnerabilities were discovered in Flatpak, an     application deployment framework for desktop apps, which could allow a     Flatpak app to delete arbitrary hosts on the host or break out of the     sandbox resulting in code execution in the host context.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 1.14.10-1~deb12u2.

    We recommend that you upgrade your flatpak packages.

    For the detailed security status of flatpak please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/flatpak

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1511-1 advisory.

    - CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options (bsc#1261769).
    - CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation (bsc#1261770).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6207 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6207-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     April 12, 2026                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : flatpak     CVE ID         : CVE-2026-34078 CVE-2026-34079

    Multiple security vulnerabilities were discovered in Flatpak, an     application deployment framework for desktop apps, which could allow a     Flatpak app to delete arbitrary hosts on the host or break out of the     sandbox resulting in code execution in the host context.

    For the stable distribution (trixie), these problems have been fixed in     version 1.16.6-1~deb13u1.

    We recommend that you upgrade your flatpak packages.

    For the detailed security status of flatpak please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/flatpak

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5286084b44 advisory.

    Update to 1.16.6

    Fixes for CVE-2026-34078, CVE-2026-34079, GHSA-2fxp-43j9-pwvc and GHSA-89xm-3m96-w3jg


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal     accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary     paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files     and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in     1.16.4. (CVE-2026-34078)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
320758	RHEL 8 : flatpak (RHSA-2026:25381)	Nessus	Red Hat Local Security Checks	critical
320372	RHEL 8 : flatpak (RHSA-2026:25068)	Nessus	Red Hat Local Security Checks	critical
319570	RHEL 10 : flatpak (RHSA-2026:23420)	Nessus	Red Hat Local Security Checks	critical
319553	RHEL 9 : flatpak (RHSA-2026:23418)	Nessus	Red Hat Local Security Checks	critical
319551	RHEL 9 : flatpak (RHSA-2026:23417)	Nessus	Red Hat Local Security Checks	critical
319516	RHEL 9 : flatpak (RHSA-2026:23419)	Nessus	Red Hat Local Security Checks	critical
318720	RockyLinux 9 : flatpak (RLSA-2026:21755)	Nessus	Rocky Linux Local Security Checks	critical
318660	RockyLinux 10 : flatpak (RLSA-2026:21757)	Nessus	Rocky Linux Local Security Checks	critical
318381	MiracleLinux 8 : flatpak-1.12.9-4.el8_10 (AXSA:2026-753:02)	Nessus	Miracle Linux Local Security Checks	critical
318315	AlmaLinux 10 : flatpak (ALSA-2026:21757)	Nessus	Alma Linux Local Security Checks	critical
317938	AlmaLinux 9 : flatpak (ALSA-2026:21755)	Nessus	Alma Linux Local Security Checks	critical
317744	RockyLinux 8 : flatpak (RLSA-2026:21756)	Nessus	Rocky Linux Local Security Checks	critical
317534	Oracle Linux 8 : flatpak (ELSA-2026-21756)	Nessus	Oracle Linux Local Security Checks	critical
317529	AlmaLinux 8 : flatpak (ALSA-2026:21756)	Nessus	Alma Linux Local Security Checks	critical
317513	RHEL 8 : flatpak (RHSA-2026:21756)	Nessus	Red Hat Local Security Checks	critical
317506	RHEL 9 : flatpak (RHSA-2026:21755)	Nessus	Red Hat Local Security Checks	critical
317503	RHEL 10 : flatpak (RHSA-2026:21757)	Nessus	Red Hat Local Security Checks	critical
313641	SUSE SLES12 Security Update : flatpak (SUSE-SU-2026:1713-1)	Nessus	SuSE Local Security Checks	critical
311319	Amazon Linux 2023 : flatpak, flatpak-devel, flatpak-libs (ALAS2023-2026-1601)	Nessus	Amazon Linux Local Security Checks	critical
311225	Amazon Linux 2 : flatpak, --advisory ALAS2-2026-3261 (ALAS-2026-3261)	Nessus	Amazon Linux Local Security Checks	critical
310694	Fedora 42 : flatpak (2026-2a3e305ac4)	Nessus	Fedora Local Security Checks	critical
310241	SUSE SLED15 / SLES15 Security Update : flatpak (SUSE-SU-2026:1600-1)	Nessus	SuSE Local Security Checks	critical
309893	SUSE SLES15 Security Update : flatpak (SUSE-SU-2026:1541-1)	Nessus	SuSE Local Security Checks	critical
309198	Debian dsa-6223 : flatpak - security update	Nessus	Debian Local Security Checks	critical
309122	SUSE SLES15 Security Update : flatpak (SUSE-SU-2026:1511-1)	Nessus	SuSE Local Security Checks	critical
307634	Debian dsa-6207 : flatpak - security update	Nessus	Debian Local Security Checks	critical
306339	Fedora 43 : flatpak (2026-5286084b44)	Nessus	Fedora Local Security Checks	critical
305259	Linux Distros Unpatched Vulnerability : CVE-2026-34078	Nessus	Misc.	critical

Detections

Analytics

CVE-2026-34078

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical