Log in Start free

Vulnerability · Published Sep 17, 2026 · Assigned by redhat

CVE-2026-86320Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)

High 7.8

In plain English

A high-severity code injection in Red Hat Enterprise Linux 10 from Red Hat. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.3%top 77.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10flatpak-builder1.4.4-1.el10_2.1ALSA-2026:80495
AlmaLinux:8flatpak-builder1.2.3-2.el8_10ALSA-2026:80973
AlmaLinux:9flatpak-builder1.2.3-1.el9_8.1ALSA-2026:80496
Alpine:v3.24flatpak-builder1.4.11-r0ALPINE-CVE-2026-86320
Debian:12flatpak-builderno fix listedDEBIAN-CVE-2026-86320
Debian:13flatpak-builderno fix listedDEBIAN-CVE-2026-86320
Debian:14flatpak-builder1.4.11-1DEBIAN-CVE-2026-86320
Rocky Linux:10flatpak-builder0:1.4.4-1.el10_2.1RLSA-2026:80495
Rocky Linux:8flatpak-builder0:1.2.3-2.el8_10RLSA-2026:80973
Rocky Linux:9flatpak-builder0:1.2.3-1.el9_8.1RLSA-2026:80496
Ubuntu:22.04:LTSflatpak-builderno fix listedUBUNTU-CVE-2026-86320
Ubuntu:24.04:LTSflatpak-builderno fix listedUBUNTU-CVE-2026-86320
Ubuntu:26.04:LTSflatpak-builderno fix listedUBUNTU-CVE-2026-86320
Ubuntu:26.10flatpak-builderno fix listedUBUNTU-CVE-2026-86320

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On see references
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On see references
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service see references
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support see references

Weakness: CWE-94 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References