CVE-2026-97026: Flatpak: flatpak: world-writable temporary child repositories in system-helper cache path
Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation failures (denial of service); tampered content would fail signature/digest verification rather than being trusted.
Other sources
GHSA-r9w3-qx54-qvc8 (https://github.com/flatpak/flatpak/security/advisories/GHSA-r9w3-qx54-qvc8)
Description: The child temporary directories allocated under the user cache (/var/tmp/flatpak-cache-) are created with mode 0777. On multi-user systems this could allow other local users to modify the app as it is being installed. This is related to GHSA-7rvf-rqr3-43j4 (CVE-2026-97025) but with a different impact. This is mitigated by a restrictive umask; it is believed to be a denial-of-service risk rather than an integrity threat, because a modified app/runtime would fail its signature or digest check. The flatpak(1) CLI, GNOME Software, and KDE Plasma Discover are believed unaffected since they set umask 022; other software using libflatpak with a permissive umask might be indirectly vulnerable.
Mitigation: Set a umask that does not allow other users to write to the cache directory (e.g. umask 022). Patched in 1.18.4 by commit 011dfae2 ("common: Restrict tmpdir permissions from 0777 to 0755"). Credit: Found by AISLE in cooperation with Red Hat.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
flatpakto a version that resolves this vulnerability.Fixed in 1.18.4Patch 011dfae2 - Configuration
Set a restrictive umask that does not allow other users to write to the cache directory; umask 022 is an example.
Flatpak/libflatpak umask = 022
Event History
Frequently Asked Questions
Which Flatpak usage scenarios are most exposed?
The risk is primarily in software that uses libflatpak with a permissive umask on a multi-user system. The flatpak CLI, GNOME Software, and KDE Plasma Discover are believed unaffected because they set umask 022.
What access would an attacker need?
An attacker would need local access as another user on the same multi-user system, with the ability to access the world-writable temporary cache directory during an app or runtime installation.
Can this be used to install untrusted or modified Flatpak content?
Modified app or runtime content is expected to fail signature or digest verification rather than be trusted. The described impact is therefore believed to be installation disruption or denial of service, not an integrity compromise.
What can be done before an update is available?
Ensure applications that use libflatpak run with a restrictive umask, such as 022. This mitigates the exposure from the temporary directories being created with permissive permissions.
How can administrators identify potentially affected software?
Identify software other than the flatpak CLI, GNOME Software, or KDE Plasma Discover that uses libflatpak, and determine whether it runs with a permissive umask. Pay particular attention to such software on systems shared by multiple local users.