Red Hat Product Errata RHSA-2026:35843 - Security Advisory Issued: 2026-07-06 Updated: 2026-07-06 RHSA-2026:35843 - Security Advisory Overview Updated Packages Synopsis Important: flatpak security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for flatpak is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078) flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64 Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64 Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le Fixes BZ - 2456276 - CVE-2026-34078 flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options BZ - 2456284 - CVE-2026-34079 flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation CVEs CVE-2026-34078 CVE-2026-34079 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 SRPM flatpak-1.12.9-3.el7_9.src.rpm SHA-256: 1b3108717115dbfe085548c5bd21d0e37813b6a8f8516cc3cc0ced845726f10b x86_64 flatpak-1.12.9-3.el7_9.x86_64.rpm SHA-256: 898235414be4d6156d327db1c8da9eb5d38d89bb540661c0f9c84e6eeb3874d5 flatpak-builder-1.0.0-16.el7_9.x86_64.rpm SHA-256: bd7fcc88a3e9e0bd6f125f49ac756adb5209b0c2846b01f376fa44becdf61f14 flatpak-debuginfo-1.12.9-3.el7_9.x86_64.rpm SHA-256: 1968290ce4c4738c920fdf59f123c489436b7c00bd6888b85168ca58de18eb08 flatpak-debuginfo-1.12.9-3.el7_9.x86_64.rpm SHA-256: 1968290ce4c4738c920fdf59f123c489436b7c00bd6888b85168ca58de18eb08 flatpak-devel-1.12.9-3.el7_9.x86_64.rpm SHA-256: 0e640ae652015f069667ced00c9df7084a8397e2820c85fd0267d977b92d37be flatpak-libs-1.12.9-3.el7_9.x86_64.rpm SHA-256: 5e81443b03da6008b279b27a16a46f1083e07e2b15847e8f7f78ab67f25a70d0 Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 SRPM flatpak-1.12.9-3.el7_9.src.rpm SHA-256: 1b3108717115dbfe085548c5bd21d0e37813b6a8f8516cc3cc0ced845726f10b s390x flatpak-1.12.9-3.el7_9.s390x.rpm SHA-256: 1643c361fec0aa40d4803cf7778a2b2b8061803fd71128a3fd64bd6dd7691f2e flatpak-builder-1.0.0-16.el7_9.s390x.rpm SHA-256: f4ced6ee9f57d4143ca69d8be696d17751e97252d7a2fd0b055a937d7ff6797a flatpak-debuginfo-1.12.9-3.el7_9.s390x.rpm SHA-256: 7983a6e12950a2eb2466d44d03bb301f1e7af20f7df6aee012ec283f1c3d8dc4 flatpak-debuginfo-1.12.9-3.el7_9.s390x.rpm SHA-256: 7983a6e12950a2eb2466d44d03bb301f1e7af20f7df6aee012ec283f1c3d8dc4 flatpak-devel-1.12.9-3.el7_9.s390x.rpm SHA-256: 8d0dade6da52098fbe6369e55c6b1087cc296f768c459d71f99eff29f5e243c3 flatpak-libs-1.12.9-3.el7_9.s390x.rpm SHA-256: 5ad5cc811de230310f12bc860453782e475700e243dbe03e92f8428c8b8aa9f5 Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 SRPM flatpak-1.12.9-3.el7_9.src.rpm SHA-256: 1b3108717115dbfe085548c5bd21d0e37813b6a8f8516cc3cc0ced845726f10b ppc64 flatpak-1.12.9-3.el7_9.ppc64.rpm SHA-256: c77681144a1f624ee4087367a14a7b0d283f7bd1828b1b0cfbb4c9e1a7a093f0 flatpak-builder-1.0.0-16.el7_9.ppc64.rpm SHA-256: 02d1ccf9d19174d4a1cea39019ce0da1ff134c1dd8bb1f9f44acaac3c6cc452f flatpak-debuginfo-1.12.9-3.el7_9.ppc64.rpm SHA-256: 212ebb63d251d45b7ea067fdfec5b55d4a312c8edba3401fbd1be106e7a3e7b1 flatpak-debuginfo-1.12.9-3.el7_9.ppc64.rpm SHA-256: 212ebb63d251d45b7ea067fdfec5b55d4a312c8edba3401fbd1be106e7a3e7b1 flatpak-devel-1.12.9-3.el7_9.ppc64.rpm SHA-256: 4e8ecd78763c1ad46420a043fecacb218246d79b2b9d724ae79c54e656d546c9 flatpak-libs-1.12.9-3.el7_9.ppc64.rpm SHA-256: f7585095bbf9c10a07aa8233d3f7578b7b4f725722bfb03e82b2616bfcb5673e Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 SRPM flatpak-1.12.9-3.el7_9.src.rpm SHA-256: 1b3108717115dbfe085548c5bd21d0e37813b6a8f8516cc3cc0ced845726f10b ppc64le flatpak-1.12.9-3.el7_9.ppc64le.rpm SHA-256: 0245e251c0e3727b1ffaa13c45fa1f44956d6d7cc3dd5232909ec3cea9f8a5e3 flatpak-builder-1.0.0-16.el7_9.ppc64le.rpm SHA-256: 159cb3c91f9ab96bd4177058559b58ecad39dd775233307031db508b3614eceb flatpak-debuginfo-1.12.9-3.el7_9.ppc64le.rpm SHA-256: fc7905e554c8c846b7535a130b50eb9e9a591d944937f9eb8529d7e77a0af6c5 flatpak-debuginfo-1.12.9-3.el7_9.ppc64le.rpm SHA-256: fc7905e554c8c846b7535a130b50eb9e9a591d944937f9eb8529d7e77a0af6c5 flatpak-devel-1.12.9-3.el7_9.ppc64le.rpm SHA-256: fa1eb691a3264d4682add0c8fffc6a97d9f4da94784a84b7405ae6ad39fc2634 flatpak-libs-1.12.9-3.el7_9.ppc64le.rpm SHA-256: 947b9395a153e2c7dc1076c8156f4968b01a3c0aa7a54b506f441c2b4b41037b The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .