CVE-2026-93676: Xdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checks
A flaw was found in xdg-dbus-proxy. The filtering logic applied to D-Bus broadcast messages does not correctly enforce the configured path, interface, and member restrictions. As a result, a malicious or compromised Flatpak application can intercept broadcast signals on the D-Bus session bus and the AT-SPI bus that should have been filtered out, potentially exposing information from other applications on the bus to an unauthorized sandboxed application.
Upstream advisory: https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-r7hp-698j-2h6c Affected versions: 0.1.6, 0.1.7 Fixed version: 0.1.8 Upstream CVSS: 3.2 (Low)
Other sources
xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted, potentially exposing sensitive information to unauthorized applications.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
xdg-dbus-proxyto a version that resolves this vulnerability.Fixed in 0.1.8Patch GHSA-r7hp-698j-2h6c
Event History
Frequently Asked Questions
Which versions need remediation?
Versions 0.1.6 and 0.1.7 are affected. Version 0.1.8 is the identified fixed version.
What does an attacker need to exploit this issue?
An attacker needs a malicious or compromised Flatpak application running in the sandbox. The issue concerns interception of broadcast signals on the D-Bus session bus and AT-SPI bus.
What information could be exposed?
Broadcast signals that configured path, interface, and member restrictions were intended to block may be delivered to an unauthorized sandboxed application. This can expose information from other applications communicating on those buses.