CVE-2026-97025

Flatpak: flatpak: world-readable oci authentication token in system-helper cache path

State: Published
Severity: 3.2 Low
Published: Sep 28, 2026
Updated: Sep 29, 2026
Reserved: Sep 23, 2026

Description

Flatpak writes the OCI repository authentication token with world-readable permissions (0644) in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources (e.g. as used by Fedora) are affected; libostree-based sources such as Flathub are not.

Scores

CVSS	Score	Vector	Source
3.1	3.2 Low	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N	redhat

Weaknesses

CWE-378 Creation of Temporary File With Insecure Permissions

Affected Products

Product	Versions
Red Hat Enterprise Linux 10Red Hat
Red Hat Enterprise Linux 7Red Hat
Red Hat Enterprise Linux 8Red Hat
Red Hat Enterprise Linux 9Red Hat

References

https://access.redhat.com/security/cve/CVE-2026-97025vdb-entry
RHBZ#2542628issue-tracking
https://github.com/flatpak/flatpak/security/advisories/GHSA-7rvf-rqr3-43j4

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.