[ CVE-2026-86320 · Published 17 Sep 2026 ]
Vulnerability in Red Hat Enterprise Linux 10
CVSS 7.8
EPSS <1%1 agency advisoryNo fix listed yet
[ Why it matters ]Priority signals
- Public proof-of-concept exploit exists (CISA SSVC)
[ Description ]Official description
A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ Advisories ]Government CERT advisories
-
BSI CERT-BundWID-SEC-2026-3861
Red Hat Enterprise Linux (flatpak): Multiple vulnerabilities Translated from German
[ References ]References
- access.redhat.com/errata/RHSA-2026:80495vendor-advisoryx_refsource_REDHAT
- access.redhat.com/errata/RHSA-2026:80496vendor-advisoryx_refsource_REDHAT
- access.redhat.com/errata/RHSA-2026:80973vendor-advisoryx_refsource_REDHAT
- access.redhat.com/errata/RHSA-2026:84832vendor-advisoryx_refsource_REDHAT
- access.redhat.com/errata/RHSA-2026:84833vendor-advisoryx_refsource_REDHAT
- access.redhat.com/errata/RHSA-2026:84834vendor-advisoryx_refsource_REDHAT
- access.redhat.com/errata/RHSA-2026:84842vendor-advisoryx_refsource_REDHAT
- access.redhat.com/errata/RHSA-2026:86714vendor-advisoryx_refsource_REDHAT
- access.redhat.com/security/cve/CVE-2026-86320vdb-entryx_refsource_REDHAT
- bugzilla.redhat.com/show_bug.cgiissue-trackingx_refsource_REDHAT
- github.com/flatpak/flatpak-builder/security/advisories/GHSA-j5p8-jgjc-f3xv