Skip to content
OpenAdvisories
High ALAS2-2026-3261 1 CVE

Important: flatpak security update (Amazon Linux 2)

Published Apr 27, 2026 · Updated Apr 29, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-34078: A complete sandbox escape vulnerability exists in Flatpak before 1.16.4. The Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox, giving apps access to all host files and enabling code execution in the host context.

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 flatpak 0:1.0.9-10.amzn2.0.7
Amazon Linux · 2 flatpak-builder 0:1.0.0-10.amzn2.0.7
Amazon Linux · 2 flatpak-debuginfo 0:1.0.9-10.amzn2.0.7
Amazon Linux · 2 flatpak-devel 0:1.0.9-10.amzn2.0.7
Amazon Linux · 2 flatpak-libs 0:1.0.9-10.amzn2.0.7

Vulnerabilities 1

  • Critical 9.3
    CVE-2026-34078

    Flatpak has a complete sandbox escape leading to host file access and code execution in the host context

    Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path i…

    Flatpak Flatpak flatpak flatpak Debian Ubuntu Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-34078.html