Bug 2542683 (CVE-2026-97027)

Summary:	CVE-2026-97027 flatpak: flatpak: Denial of service via unsanitized keys in exported Desktop Entry / D-Bus Service files
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry (.desktop) and D-Bus Service (.service) files, instead of validating against an allowlist. A malicious Flatpak app can use this to cause denial of service (e.g. forced application restart loops) or to influence host D-Bus/systemd activation behavior beyond what the sandbox is intended to permit.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-28 20:36:55 UTC

GHSA-v64f-hrwr-j4vh (https://github.com/flatpak/flatpak/security/advisories/GHSA-v64f-hrwr-j4vh)

Description: A malicious Flatpak application can influence host system behavior beyond its sandbox by including arbitrary keys in its exported Desktop Entry (.desktop) or D-Bus Service (.service) files. This can lead to denial of service (e.g. X-GNOME-AutoRestart causing unconditional application restarts) or unintended interaction with host services (e.g. SystemdService directing the D-Bus daemon to activate a host systemd unit instead of the sandboxed wrapper). When Flatpak exports these files, it rewrites Exec= to go through the flatpak run wrapper and removes a small denylist of known-dangerous keys, but passes all other keys through unmodified. The fix switches from a denylist to an allowlist, exporting only keys from a curated list of known-safe entries.

Mitigation: Only install applications from trusted sources. Patched in 1.18.4 by commit 33931025 ("dir: Validate Desktop Entry and D-Bus Service"). Credit: Reported by Markus Göllnitz.