Bug 2542637 (CVE-2026-97026)

Summary:	CVE-2026-97026 flatpak: flatpak: World-writable temporary child repositories in system-helper cache path
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation failures (denial of service); tampered content would fail signature/digest verification rather than being trusted.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-28 20:16:51 UTC

GHSA-r9w3-qx54-qvc8 (https://github.com/flatpak/flatpak/security/advisories/GHSA-r9w3-qx54-qvc8)

Description: The child temporary directories allocated under the user cache (/var/tmp/flatpak-cache-*) are created with mode 0777. On multi-user systems this could allow other local users to modify the app as it is being installed. This is related to GHSA-7rvf-rqr3-43j4 (CVE-2026-97025) but with a different impact. This is mitigated by a restrictive umask; it is believed to be a denial-of-service risk rather than an integrity threat, because a modified app/runtime would fail its signature or digest check. The flatpak(1) CLI, GNOME Software, and KDE Plasma Discover are believed unaffected since they set umask 022; other software using libflatpak with a permissive umask might be indirectly vulnerable.

Mitigation: Set a umask that does not allow other users to write to the cache directory (e.g. umask 022). Patched in 1.18.4 by commit 011dfae2 ("common: Restrict tmpdir permissions from 0777 to 0755"). Credit: Found by AISLE in cooperation with Red Hat.