Skip to content
Fencer Vulns
high 7.8

CVE-2026-86320 json

Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)

published 2026-09-17 53 d ago modified 2026-11-03 6 d ago also EUVD-2026-81387

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 22%
public exploits
0
none known

Summary

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 0:1.4.4-1.el10_2.1
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:1.4.4-1.el10_0.1
  • Red Hat Red Hat Enterprise Linux 8 0:1.2.3-2.el8_10
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:1.0.9-4.el8_4
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:1.0.9-4.el8_4
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:1.0.9-4.el8_6
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 0:1.0.9-4.el8_6
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:1.0.14-3.el8_8
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:1.0.14-3.el8_8
  • Red Hat Red Hat Enterprise Linux 9 0:1.2.3-1.el9_8.1
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:1.2.2-2.el9_2
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:1.2.3-2.el9_4
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:1.2.3-1.el9_6.1
  • flatpak-builder Debian 14 1.4.11-1

debian advisories DEBIAN-CVE-2026-86320

  • flatpak-builder RHEL 8 1.2.3-2.el8_10
  • flatpak-builder RHEL 10.2 1.4.4-1.el10_2.1
  • flatpak-builder RHEL 9 1.2.3-1.el9_8.1
  • flatpak-builder RHEL 9.2 E4S 1.2.2-2.el9_2
  • flatpak-builder RHEL 9.6 EUS 1.2.3-1.el9_6.1
  • flatpak-builder enterprise linux eus 10.0 1.4.4-1.el10_0.1
  • flatpak-builder RHEL 9.4 E4S 1.2.3-2.el9_4

red hat advisories RHSA-2026:84842RHSA-2026:84833RHSA-2026:84834RHSA-2026:84832RHSA-2026:80973RHSA-2026:80495

  • flatpak-builder openSUSE Tumbleweed 1.4.12-1.1

opensuse advisories openSUSE-SU-2026:11845-1

  • flatpak-builder AlmaLinux 10 1.4.4-1.el10_2.1
  • flatpak-builder AlmaLinux 9 1.2.3-1.el9_8.1
  • flatpak-builder AlmaLinux 8 1.2.3-2.el8_10

almalinux advisories ALSA-2026:80495ALSA-2026:80496ALSA-2026:80973

  • flatpak-builder Rocky Linux 8 1.2.3-2.el8_10
  • flatpak-builder Rocky Linux 10 1.4.4-1.el10_2.1
  • flatpak-builder Rocky Linux 9 1.2.3-1.el9_8.1

rocky linux advisories RLSA-2026:80973RLSA-2026:80495RLSA-2026:80496

  • flatpak-builder Alpine 3.24 1.4.11-r0

alpine advisories ALPINE-CVE-2026-86320

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-86320 updated cvss 7.8

flatpak-builder: Host code execution via `git am` hook execution in patch source extraction (`use-git-am`)

  • Red Hat Enterprise Linux AppStream (v. 8) flatpak-builder 1.2.3-2.el8_10
    fixed: vendor fix RHSA-2026:80973
  • Red Hat Enterprise Linux AppStream (v. 9) flatpak-builder 1.2.3-1.el9_8.1
    fixed: vendor fix RHSA-2026:80496
  • Red Hat Enterprise Linux AppStream (v. 10) flatpak-builder 1.4.4-1.el10_2.1
    fixed: vendor fix RHSA-2026:80495
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) flatpak-builder 1.0.9-4.el8_4
    fixed: vendor fix RHSA-2026:92220
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) flatpak-builder 1.0.9-4.el8_6
    fixed: vendor fix RHSA-2026:90896
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) flatpak-builder 1.0.14-3.el8_8
    fixed: vendor fix RHSA-2026:86714
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) flatpak-builder 1.2.2-2.el9_2
    fixed: vendor fix RHSA-2026:84842
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) flatpak-builder 1.2.3-2.el9_4
    fixed: vendor fix RHSA-2026:84832
show 5 more
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) flatpak-builder 1.4.4-1.el10_0.1
    fixed: vendor fix RHSA-2026:84834
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) flatpak-builder 1.2.3-1.el9_6.1
    fixed: vendor fix RHSA-2026:84833
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) flatpak-builder 1.0.9-4.el8_4
    fixed: vendor fix RHSA-2026:92220
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) flatpak-builder 1.0.9-4.el8_6
    fixed: vendor fix RHSA-2026:90896
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) flatpak-builder 1.0.14-3.el8_8
    fixed: vendor fix RHSA-2026:86714

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
52 d ago

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2471023 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/flatpak/flatpak-builder/security/advisories/GHSA-j5p8-jgjc-f3xv referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.