Bug 2542683 (CVE-2026-97027) - CVE-2026-97027 flatpak: flatpak: Denial of service via unsanitized keys in exported Desktop Entry / D-Bus Service files
Summary: CVE-2026-97027 flatpak: flatpak: Denial of service via unsanitized keys in ex...
Keywords:
Status: NEW
Alias: CVE-2026-97027
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-28 20:36 UTC by OSIDB Bzimport
Modified: 2026-09-28 20:36 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-28 20:36:55 UTC 
GHSA-v64f-hrwr-j4vh (https://github.com/flatpak/flatpak/security/advisories/GHSA-v64f-hrwr-j4vh)

Description: A malicious Flatpak application can influence host system behavior beyond its sandbox by including arbitrary keys in its exported Desktop Entry (.desktop) or D-Bus Service (.service) files. This can lead to denial of service (e.g. X-GNOME-AutoRestart causing unconditional application restarts) or unintended interaction with host services (e.g. SystemdService directing the D-Bus daemon to activate a host systemd unit instead of the sandboxed wrapper). When Flatpak exports these files, it rewrites Exec= to go through the flatpak run wrapper and removes a small denylist of known-dangerous keys, but passes all other keys through unmodified. The fix switches from a denylist to an allowlist, exporting only keys from a curated list of known-safe entries.

Mitigation: Only install applications from trusted sources. Patched in 1.18.4 by commit 33931025 ("dir: Validate Desktop Entry and D-Bus Service"). Credit: Reported by Markus Göllnitz.
Note You need to log in before you can comment on or make changes to this bug.