CVE-2026-93676: Xdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checks

Published Sep 18, 2026
·
Updated

A flaw was found in xdg-dbus-proxy. The filtering logic applied to D-Bus broadcast messages does not correctly enforce the configured path, interface, and member restrictions. As a result, a malicious or compromised Flatpak application can intercept broadcast signals on the D-Bus session bus and the AT-SPI bus that should have been filtered out, potentially exposing information from other applications on the bus to an unauthorized sandboxed application.

Upstream advisory: https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-r7hp-698j-2h6c Affected versions: 0.1.6, 0.1.7 Fixed version: 0.1.8 Upstream CVSS: 3.2 (Low)

Other sources

xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted, potentially exposing sensitive information to unauthorized applications.

MITRE

Affected Software

1 affected component
Flatpak xdg-dbus-proxy>=0.1.6<=0.1.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade xdg-dbus-proxy to a version that resolves this vulnerability.

    Fixed in 0.1.8Patch GHSA-r7hp-698j-2h6c

Event History

Sep 18, 2026
Data Sourced
via Red Hat·02:09 PM
DescriptionSeverityAffected Software
CVE Published
via MITRE·02:19 PM
Data Sourced
via MITRE·02:19 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Which versions need remediation?

Versions 0.1.6 and 0.1.7 are affected. Version 0.1.8 is the identified fixed version.

2

What does an attacker need to exploit this issue?

An attacker needs a malicious or compromised Flatpak application running in the sandbox. The issue concerns interception of broadcast signals on the D-Bus session bus and AT-SPI bus.

3

What information could be exposed?

Broadcast signals that configured path, interface, and member restrictions were intended to block may be delivered to an unauthorized sandboxed application. This can expose information from other applications communicating on those buses.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203