CVE-2026-93676

xdg-dbus-proxy, the sandboxing helper that mediates D-Bus access for Flatpak applications, incorrectly filters D-Bus broadcast messages, bypassing the path, interface, and member restrictions configured for a sandbox. A malicious or compromised application running inside a Flatpak sandbox can listen for broadcast signals on the D-Bus session bus and the AT-SPI accessibility bus that should have been blocked, potentially exposing sensitive information to applications not authorized to receive it. Exploitation is local and low-impact: it requires the attacker to already control a sandboxed app on the target system and involves user interaction (e.g., the victim installing and running the malicious app), with only limited information disclosure and no integrity or availability impact (CVSS 3.2, low). All Linux systems that use xdg-dbus-proxy as part of Flatpak sandboxing are affected, with fixed versions defined in the upstream advisory GHSA-r7hp-698j-2h6c. No public proof of concept is known, the issue is not on the CISA KEV list, and there is no indication of exploitation in the wild.

What to do: Update xdg-dbus-proxy to the fixed release specified in GHSA-r7hp-698j-2h6c via your distribution's security packages (e.g., dnf/apt upgrade) once available, since no specific fixed version number is stated here. Review permissions granted to installed Flatpak apps with 'flatpak override' and prefer well-known apps from trusted remotes, as exploitation requires running a malicious sandboxed application. Monitor Red Hat and other distro advisories for this CVE, and note the practical risk is low: impact is limited to information disclosure from broadcast signals with user interaction required.