CVE-2026-97026

LowCVSS 3.9/10Last modified Sep 30, 2026

Description

Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation failures (denial of service); tampered content would fail signature/digest verification rather than being trusted.

Metrics

CVSS 3.1 3.9/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-378

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 28, 2026
Last modified
Sep 30, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-970273.6Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry (.desktop) and D-Bus ServiceCVE-2026-970295.7Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching procesCVE-2026-97037.1Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only thCVE-2026-970306.1A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escapedCVE-2026-970317.5Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could tCVE-2026-970327.5HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifiesCVE-2026-97048.8A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subject_tokenCVE-2026-97056.5A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token (RATCVE-2026-970558.1SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret (tokenizer::jwt::secret, set via SIGNOZ_TOKENIZER_JWT_SECRET orCVE-2026-970566.8SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured to use the opaque session tokenizer (which was not the defaCVE-2026-970577.5redis-parser through 3.0.0 fails to validate the multi-bulk length value in RESP protocol parsing, allowing attackers to trigger an uncaughtCVE-2026-970598.2DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the Pixe