CVE-2026-96279 in Red Hat
Summary
by MITRE • 09/27/2026
A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as /etc/shadow.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/27/2026
The vulnerability described involves a critical security flaw in the interaction between Flatpak and Open Container Initiative (OCI) registries, specifically affecting the application installation and update mechanisms. This issue arises from an improper handling of file extraction during the unpacking process of OCI images used by Flatpak. When a user installs or updates a Flatpak application sourced from a malicious OCI registry, the container runtime fails to adequately isolate the filesystem operations within the designated sandboxed environment. Instead of strictly confining file creation and modification to the intended target directory for the extracted content, the underlying implementation allows for the manipulation of symbolic links or hardlinks that point outside this restricted scope. This lack of strict path validation enables an attacker-controlled registry to instruct the extraction process to create hardlinks pointing to arbitrary files on the host system's filesystem.
From a technical perspective, this flaw represents a classic case of insufficient isolation between containerized workloads and the host environment. The vulnerability leverages the behavior of standard Unix file systems where hard links allow multiple directory entries to refer to the same inode. By exploiting this feature during the image extraction phase, an attacker can effectively bypass the intended sandbox boundaries. When Flatpak processes a malicious OCI manifest that includes instructions to link sensitive system files into the application's data or configuration directories, these operations are executed with the privileges of the user performing the installation. In scenarios where the installation is performed as root for system-wide deployment, the attack vector expands significantly in scope and severity. The attacker gains the ability to read any file accessible by the root account on the host machine.
The operational impact of this vulnerability is severe, particularly regarding data confidentiality and integrity. For standard user-level installations, an attacker could potentially access sensitive configuration files, cached credentials, or personal documents stored within the user's home directory. However, the risk escalates dramatically for system-wide installations running with root privileges. In such cases, the malicious registry can force the extraction of critical system security files, most notably /etc/shadow on Linux systems. This file contains hashed passwords and account status information for all users on the machine. Disclosure of this data allows attackers to perform offline brute-force attacks against user credentials, potentially leading to full compromise of individual accounts or even root access if weak password policies are in place. Furthermore, depending on specific configurations, other sensitive files such as SSH keys, private certificates, and database configuration files containing plaintext passwords could also be exposed.
This vulnerability aligns with several established industry standards for categorizing security flaws. It is primarily classified under CWE-20 Improper Input Validation, specifically regarding the failure to validate paths during file extraction operations within a containerized context. Additionally, it relates to CWE-732 Incorrect Permission Assignment for Critical Resource, as the sandboxing mechanism fails to enforce strict permissions on extracted files relative to their intended location. In terms of attack tactics, this aligns with MITRE ATT&CK techniques related to Collection and Exfiltration over Alternative Protocol, where attackers use non-standard channels or mechanisms like OCI registries to gather data from compromised systems. The exploitation also touches upon CWE-269 Improper Privilege Management if the vulnerability is triggered during a privileged installation process that should have stricter safeguards in place.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. Users and system administrators should immediately update Flatpak to versions where this extraction logic has been patched to strictly validate all file paths against the target directory before creating links or writing files. It is crucial to verify that the OCI registry being used for application distribution is trusted and reputable, avoiding sources from unverified entities until patches are widely deployed. For organizations deploying Flatpak system-wide, it is advisable to review installation scripts and ensure they do not unnecessarily run with root privileges unless absolutely required by specific applications. Implementing mandatory access control systems such as SELinux or AppArmor can provide an additional layer of defense by restricting what files the extraction process can access regardless of application-level vulnerabilities. Regular auditing of OCI registries used in enterprise environments is also recommended to detect any signs of tampering or malicious content injection before deployment occurs.