CVE-2026-34080: 
NixOS vulnerability analysis and mitigation

CVE-2026-34080 is an eavesdrop filter bypass vulnerability in xdg-dbus-proxy, a filtering proxy for D-Bus connections used primarily by Flatpak. The flaw exists in the policy parser, which correctly checks for eavesdrop=true in policy rules but fails to handle variants such as eavesdrop ='true' (with a space before the equals sign), allowing clients to intercept D-Bus messages they should not have access to. All versions prior to 0.1.7 are affected. It was disclosed on April 7, 2026, with a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 6.8 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-1289 (Improper Validation of Unsafe Equivalence in Input): the policy parser performs a strict string match for eavesdrop=true but does not normalize or canonicalize attribute-value pairs before comparison, leaving whitespace variants unrecognized as eavesdrop-enabling rules (GitHub Advisory). An attacker with low privileges on a local system can craft a D-Bus match rule containing a spacing variation (e.g., eavesdrop ='true') that the proxy fails to block, effectively bypassing the eavesdrop restriction and enabling interception of session bus messages. No user interaction is required, and the attack vector is local. The vulnerability was reported by Codean Labs (oss-security).

Successful exploitation allows a low-privileged local attacker — in practice most likely a malicious or compromised Flatpak application — to intercept D-Bus session bus messages that should be inaccessible to them, resulting in a high confidentiality impact (oss-security, GitHub Advisory). There is no integrity or availability impact. Sensitive data transmitted over the D-Bus session bus — such as credentials, application state, or inter-process communication content — may be exposed to the attacker.

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify target: Confirm the target system runs a vulnerable version of xdg-dbus-proxy (< 0.1.7), typically as part of a Flatpak sandbox environment.
2. Gain local access: Obtain low-privileged local code execution on the target system, for example through a malicious or compromised Flatpak application running inside a sandbox.
3. Craft malformed match rule: Construct a D-Bus match rule that includes an eavesdrop attribute with a spacing variant not recognized by the proxy's parser, such as eavesdrop ='true' (space before the equals sign).
4. Register the match rule: Submit the crafted match rule to the D-Bus session bus via the xdg-dbus-proxy. Because the proxy fails to identify the malformed rule as an eavesdrop request, it does not block it.
5. Intercept messages: With the match rule accepted, receive and read D-Bus session bus messages that should have been restricted, potentially capturing sensitive inter-process communication data (GitHub Advisory, oss-security).

• Logs: D-Bus session logs showing unexpected match rule registrations from sandboxed Flatpak applications, particularly rules containing eavesdrop with non-standard spacing (e.g., eavesdrop = or eavesdrop= ).
• Process: Flatpak application processes making unusual D-Bus calls or registering match rules that include eavesdrop-related attributes outside of expected application behavior.
• File System: Presence of xdg-dbus-proxy binaries with version strings earlier than 0.1.7 on the system (xdg-dbus-proxy --version).

Upgrade xdg-dbus-proxy to version 0.1.7 or later, which fixes the policy parser to correctly handle spacing variants in eavesdrop attribute-value pairs (GitHub Advisory). No known configuration-based workaround exists other than updating. Patches have been issued for Debian (DSA-6209-1, DLA-4542-1, DSA-6224-1), Ubuntu (USN-8167-1), and Fedora (linuxsecurity.com). Administrators should verify the installed version and apply the appropriate distribution package update promptly.

The vulnerability was reported by Codean Labs and disclosed via the GitHub Security Advisory and the oss-security mailing list by Simon McVittie on April 10–11, 2026 (oss-security, GitHub Advisory). Coverage has been limited to Linux security news outlets and distribution security advisories for Debian, Ubuntu, and Fedora, with no significant broader media attention or notable social media discussion beyond a brief mention on Bluesky.