CVE-2026-97026 in Red Hat
Summary
by MITRE • 09/29/2026
Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation failures (denial of service); tampered content would fail signature/digest verification rather than being trusted.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in Flatpak involves an insecure handling of temporary file system resources during the application and runtime installation processes. Specifically, when Flatpak creates child repository directories within the user cache directory to facilitate these operations, it assigns them world-writable permissions with a mode of 0777. This configuration allows any local user on the same system to read, write, or modify files within that temporary directory. On multi-user systems where users operate under permissive umask settings, this lack of restrictive access control creates a significant security gap. The core technical flaw lies in the failure to apply secure temporary file creation practices, such as using restricted permissions (e.g., 0700) or utilizing atomic operations that prevent race conditions and unauthorized access during the brief window when these directories exist.
From an operational perspective, this vulnerability primarily manifests as a denial of service against the installation process itself rather than leading to immediate code execution or privilege escalation. An attacker with local user privileges can target another user's Flatpak installation by modifying or deleting files within the temporary repository directory while it is being populated. This interference causes the installation operation to fail because the expected file structure becomes corrupted or incomplete. Consequently, legitimate users are unable to install or update applications and runtimes, disrupting their workflow and system functionality. The impact is localized to availability rather than confidentiality or integrity of persistent data, as the temporary nature of these directories means that any tampered content does not persist in a way that would compromise future operations once the installation fails.
It is critical to note that this vulnerability does not result in the execution of malicious code through trust exploitation. Flatpak employs robust signature and digest verification mechanisms for all installed applications and runtimes. If an attacker successfully modifies files within the temporary directory, those modifications will be detected during the final validation phase before any content is committed to the permanent repository. The cryptographic checks ensure that tampered packages are rejected rather than trusted or executed. Therefore, while the vulnerability allows for disruption of service, it does not allow an attacker to bypass security controls to install malicious software under the guise of a legitimate update. This distinction highlights that the primary risk is availability degradation rather than integrity compromise of installed binaries.
This issue aligns with CWE-378, which describes the creation of a temporary file with insecure permissions, and CWE-59, involving improper link resolution before use if symbolic links are involved in the directory structure. In terms of adversary behavior, this vulnerability supports techniques associated with ATT&CK T1496, Resource Hijacking, specifically through denial of service against user processes, although it is more accurately categorized under local privilege escalation attempts that fail due to application-level safeguards or general availability attacks within a multi-user environment. The lack of restrictive permissions on temporary resources is a common pattern in software development where convenience overrides security best practices during file system operations.
To mitigate this vulnerability, the Flatpak maintainers must enforce strict permission settings when creating temporary directories for repository operations. Implementing secure coding standards that mandate restricted access modes, such as 0700 or relying on operating-system provided secure temporary directory functions like mkdtemp with appropriate umask handling, would prevent other local users from accessing these sensitive resources. Additionally, ensuring that file creation is atomic and that permissions are set immediately upon directory creation can further reduce the window of exposure. System administrators should also consider enforcing stricter default umasks across user accounts to minimize the impact of any remaining permission-related vulnerabilities in system utilities. Regular auditing of temporary file handling practices within core system components like Flatpak is essential to maintain a secure multi-user environment and prevent availability-based attacks that exploit loose access controls.