SUSE-SU-2026:5127-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2026/suse-su-20265127-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5127-1.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-SU-2026:5127-1
Upstream
CVE (11)
Related
CVE (11)
Published
2026-11-06T08:27:38Z
Modified
2026-11-07T11:30:04Z
Summary
Security update for flatpak
Details

This update for flatpak fixes the following issues:

  • CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options (bsc#1261769).
  • CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation (bsc#1261770).
  • CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host (bsc#1280236).
  • CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream (bsc#1282514).
  • CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).
  • CVE-2026-96276: arbitrary write in host context via flatpak build-init (bsc#1282516).
  • CVE-2026-96280: buffer overflow in OCI delta stream path names (bsc#1282518).
  • CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).
  • CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).
  • CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on .ld.so (bsc#1282523).
  • CVE-2026-96808: revokefs symlink path traversal allows local privilege escalation via commit tampering (bsc#1282524).

Changes for flatpak:

  • Update to version 1.16.6 (jsc#PED-17048):
  • Fix file descriptor leaks affecting Chromium-based browsers.
  • Fix installing extra-data without a runtime, including OpenH264.
  • Ignore unusable sandbox-expose paths for portal sub-sandboxes, fixing Epiphany regressions.
  • Fix installed tests and handling of standard file descriptors passed as invalid flatpak run arguments.
  • Switch from Autotools to Meson, preserving system bubblewrap, xdg-dbus-proxy, curl and distribution-specific installation paths.
  • Require bubblewrap >= 0.10.0 and GPGME >= 1.8.0; add Meson, gettext, gtk-doc and polkit-agent build dependencies and drop obsolete intltool and libelf build dependencies.
  • Generate the system-user pre-script from the Meson build directory and package the tmpfiles configuration and renamed manual pages.
References

Affected packages

SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
flatpak

Package

Name
flatpak
Purl
pkg:rpm/suse/flatpak&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.16.6-150500.3.21.1

Ecosystem specific 

{
    "binaries": [
        {
            "flatpak": "1.16.6-150500.3.21.1",
            "flatpak-devel": "1.16.6-150500.3.21.1",
            "flatpak-remote-flathub": "1.16.6-150500.3.21.1",
            "flatpak-zsh-completion": "1.16.6-150500.3.21.1",
            "libflatpak0": "1.16.6-150500.3.21.1",
            "system-user-flatpak": "1.16.6-150500.3.21.1",
            "typelib-1_0-Flatpak-1_0": "1.16.6-150500.3.21.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5127-1.json"
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
flatpak

Package

Name
flatpak
Purl
pkg:rpm/suse/flatpak&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.16.6-150500.3.21.1

Ecosystem specific 

{
    "binaries": [
        {
            "flatpak": "1.16.6-150500.3.21.1",
            "flatpak-devel": "1.16.6-150500.3.21.1",
            "flatpak-remote-flathub": "1.16.6-150500.3.21.1",
            "flatpak-zsh-completion": "1.16.6-150500.3.21.1",
            "libflatpak0": "1.16.6-150500.3.21.1",
            "system-user-flatpak": "1.16.6-150500.3.21.1",
            "typelib-1_0-Flatpak-1_0": "1.16.6-150500.3.21.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5127-1.json"
SUSE:Linux Enterprise Server 15 SP5-LTSS
flatpak

Package

Name
flatpak
Purl
pkg:rpm/suse/flatpak&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.16.6-150500.3.21.1

Ecosystem specific 

{
    "binaries": [
        {
            "flatpak": "1.16.6-150500.3.21.1",
            "flatpak-devel": "1.16.6-150500.3.21.1",
            "flatpak-remote-flathub": "1.16.6-150500.3.21.1",
            "flatpak-zsh-completion": "1.16.6-150500.3.21.1",
            "libflatpak0": "1.16.6-150500.3.21.1",
            "system-user-flatpak": "1.16.6-150500.3.21.1",
            "typelib-1_0-Flatpak-1_0": "1.16.6-150500.3.21.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5127-1.json"
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
flatpak

Package

Name
flatpak
Purl
pkg:rpm/suse/flatpak&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.16.6-150500.3.21.1

Ecosystem specific 

{
    "binaries": [
        {
            "flatpak": "1.16.6-150500.3.21.1",
            "flatpak-devel": "1.16.6-150500.3.21.1",
            "flatpak-remote-flathub": "1.16.6-150500.3.21.1",
            "flatpak-zsh-completion": "1.16.6-150500.3.21.1",
            "libflatpak0": "1.16.6-150500.3.21.1",
            "system-user-flatpak": "1.16.6-150500.3.21.1",
            "typelib-1_0-Flatpak-1_0": "1.16.6-150500.3.21.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5127-1.json"