https://seclists.org/oss-sec/2026/q2/61: 4 security fixes in Flatpak, including critical CVE-2026-34078: Complete sandbox escape leading to host file access and code execution in the host context
Published Apr 9, 2026
·Updated
Affected Software
1 affected component
Flatpak Flatpak
Frequently Asked Questions
1
What is the severity of CVE-2026-34078?
CVE-2026-34078 is classified as a critical vulnerability due to its potential to allow complete sandbox escape.
2
How do I fix CVE-2026-34078?
To fix CVE-2026-34078, update your Flatpak installation to the latest patched version released after April 9, 2026.
3
What are the consequences of CVE-2026-34078?
The consequences of CVE-2026-34078 include unauthorized access to host files and possible code execution in the host context.
4
Who is affected by CVE-2026-34078?
Users of Flatpak that have a system OCI repository configured are affected by CVE-2026-34078.
5
What is the nature of the vulnerability in CVE-2026-34078?
CVE-2026-34078 allows arbitrary read-access to files in the system-helper context, leading to a complete sandbox escape.