Vulnerability · Published Sep 27, 2026 · Assigned by redhat
CVE-2026-96283Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pull
Low 3.3
In plain English
A low-severity missing authorization in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.1%top 98.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | flatpak | 1.14.10-1~deb12u2 | DEBIAN-CVE-2026-96283 |
| Debian:13 | flatpak | 1.16.4-1 | DEBIAN-CVE-2026-96283 |
| Debian:14 | flatpak | 1.16.4-1 | DEBIAN-CVE-2026-96283 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
References
- https://access.redhat.com/security/cve/CVE-2026-96283 vdb-entry, x_refsource_REDHAT
- RHBZ#2539424 issue-tracking, x_refsource_REDHAT
- https://github.com/flatpak/flatpak/security/advisories/GHSA-89xm-3m96-w3jg