CVE-2026-97025

LowCVSS 3.2/10Last modified Sep 29, 2026

Description

Flatpak writes the OCI repository authentication token with world-readable permissions (0644) in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources (e.g. as used by Fedora) are affected; libostree-based sources such as Flathub are not.

Metrics

CVSS 3.1 3.2/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-378

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 28, 2026
Last modified: Sep 29, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-970263.9Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems wi CVE-2026-970273.6Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry (.desktop) and D-Bus Service CVE-2026-970295.7Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching proces CVE-2026-97037.1Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only th CVE-2026-970306.1A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped CVE-2026-970317.5Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could t CVE-2026-970327.5HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies CVE-2026-97048.8A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subject_token CVE-2026-97056.5A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token (RAT CVE-2026-970558.1SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret (tokenizer::jwt::secret, set via SIGNOZ_TOKENIZER_JWT_SECRET or CVE-2026-970566.8SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured to use the opaque session tokenizer (which was not the defa CVE-2026-970577.5redis-parser through 3.0.0 fails to validate the multi-bulk length value in RESP protocol parsing, allowing attackers to trigger an uncaught