Skip to content
OpenAdvisories
Medium USN-8167-1 1 CVE

xdg-dbus-proxy vulnerability

Published Apr 13, 2026 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that xdg-dbus-proxy incorrectly handled eavesdropping
in policy rules. A local attacker could possibly use this issue to
intercept certain D-Bus messages.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS xdg-dbus-proxy 0.1.3-1ubuntu0.1
Ubuntu · 24.04 LTS 24.04:LTS xdg-dbus-proxy 0.1.5-1ubuntu0.2
Ubuntu · 25.10 xdg-dbus-proxy 0.1.6-1ubuntu0.1

Vulnerabilities 1

  • Medium 6.8
    CVE-2026-34080

    xdg-dbus-proxy has an eavesdrop filter bypass allowing message interception

    xdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop restrictions. The proxy checks for eavesdrop=true in policy rules but fails to handle eavesdrop ='true' (with a space before th…

    Flatpak xdg-dbus-proxy xdg-dbus-proxy xdg-dbus-proxy Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2026-34080