CVE-2026-34078: 
NixOS vulnerability analysis and mitigation

CVE-2026-34078 is a critical sandbox escape vulnerability in Flatpak, the Linux application sandboxing and distribution framework, that allows any sandboxed application to read and write arbitrary files on the host and execute code in the host context. It affects all Flatpak versions prior to 1.16.4 and was disclosed on April 7, 2026, by Codean Labs. The vulnerability was patched in Flatpak 1.16.4 (with a fix also planned for the upcoming 1.18.0 release). It carries a CVSS v3.1 base score of 10.0 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory, Feedly).

The root cause is improper handling of symbolic links (CWE-61: UNIX Symbolic Link Following) in the Flatpak portal's sandbox-expose options. A sandboxed application can place app-controlled symlinks in paths submitted to the portal's sandbox-expose mechanism; when flatpak run resolves these symlinks, it mounts the resolved host path — which can be any arbitrary location on the host filesystem — into the sandbox. This effectively bypasses the intended sandbox isolation entirely, granting the app unrestricted access to host files and providing a primitive for host-context code execution. The attack requires no special privileges beyond running a Flatpak application and no user interaction (GitHub Advisory, oss-security).

Successful exploitation gives a malicious or compromised Flatpak application complete access to all host files, enabling full confidentiality, integrity, and availability compromise of the host system. An attacker can read sensitive files (credentials, private keys, user data), overwrite or delete arbitrary host files, and leverage the file access primitive to execute arbitrary code with host-level privileges — effectively escaping the sandbox entirely. All users running any Flatpak application on an unpatched system are at risk, and the vulnerability can serve as a stepping stone for lateral movement or persistence on the host (GitHub Advisory, Feedly).

Exploitation has been reported in the wild, with linuxcompatible.org among sources noting active exploitation (Feedly). The vulnerability requires no authentication, no user interaction, and no special privileges beyond running a Flatpak app, making it trivially exploitable by any sandboxed application. The EPSS score is approximately 0.00155 (low probability of automated exploitation), and no CISA KEV catalog listing was identified at time of writing. No public proof-of-concept exploit code has been confirmed, though the technique is straightforward given the advisory description. The Tails privacy OS issued an emergency update (version 7.6.2) specifically to address this flaw, underscoring its real-world severity (Tails Release, Tor Project Blog).

1. Develop or compromise a Flatpak app: The attacker controls or compromises a Flatpak application running in a sandbox on the target system.
2. Create a malicious symlink: Within the app's writable sandbox directories, create a symbolic link pointing to an arbitrary sensitive path on the host (e.g., ln -s /etc/shadow /app/data/exposed_link).
3. Submit symlink path via sandbox-expose: Use the Flatpak portal API to submit the symlink path as a sandbox-expose option, requesting that the portal expose this path to the sandbox.
4. Trigger path resolution: When flatpak run processes the sandbox-expose option, it resolves the symlink and mounts the resolved host path (e.g., /etc/shadow) into the sandbox rather than the symlink itself.
5. Access arbitrary host files: The sandboxed app now has direct read/write access to the mounted host path, bypassing sandbox isolation entirely.
6. Escalate to code execution: Use the file access primitive to overwrite host executables, cron jobs, or configuration files, or to read credentials/keys enabling further compromise of the host system (GitHub Advisory, oss-security).

• File System: Unexpected symbolic links in Flatpak app data directories (e.g., ~/.var/app/<app-id>/) pointing to sensitive host paths such as /etc/, /root/, or /home/; unexpected modifications to host files (credentials, SSH keys, cron jobs) with timestamps correlating to Flatpak app execution.
• Logs: Flatpak portal logs (journalctl --user -u flatpak-portal) showing sandbox-expose requests referencing symlink paths or unusual host directories; flatpak run invocations in system logs mounting unexpected host paths.
• Process: Unusual child processes spawned from within a Flatpak sandbox context accessing files outside the expected app data directories; unexpected reads of /etc/shadow, /etc/passwd, SSH private keys, or other sensitive files by Flatpak-related processes.
• Network: Outbound connections from Flatpak app processes to external IPs shortly after sandbox-expose operations, potentially indicating data exfiltration following host file access (GitHub Advisory, Feedly).

Upgrade Flatpak to version 1.16.4 or later, which contains the fix; a patch is also planned for the upcoming 1.18.0 release. As a temporary workaround, the Flatpak Portal service can be disabled with sudo systemctl --global mask flatpak-portal.service && systemctl --user stop flatpak-portal.service, though this may cause some Flatpak apps to misbehave. Major Linux distributions including Debian, SUSE/openSUSE, Red Hat/AlmaLinux/Rocky Linux, Amazon Linux, Fedora, and Mageia have all issued updated packages. Organizations should prioritize patching all systems running Flatpak ≤ 1.16.3 and audit installed Flatpak applications for potentially malicious behavior (GitHub Advisory, Feedly).

The vulnerability was reported by Codean Labs and disclosed by Flatpak maintainer Simon McVittie via the oss-security mailing list alongside three other Flatpak security fixes (oss-security). The Tails privacy OS issued an emergency release (7.6.2) specifically to address this flaw, with the Tor Project highlighting the urgency for privacy-sensitive users (Tor Project Blog). Security media including Help Net Security, Hackaday, The Hacker News, and XDA Developers covered the release, with community forums on Privacy Guides and MalwareTips discussing the severity. The Western Australian Government Cyber Security Unit also issued an advisory (WA Gov Advisory). The disclosure also prompted identification of a related (less severe) symlink TOCTOU issue in xdg-desktop-portal (GHSA-rqr9-jwwf-wxgj), also reported by Codean Labs (oss-security).