Creation of Temporary File With Insecure Permissions in Flatpak - CVE-2026-97025

Vulnerability identifier: #VU152566

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-97025

CWE-ID: CWE-378

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to disclose OCI authentication tokens.

The vulnerability exists due to insecure file permissions in the OCI token cache path when downloading apps or runtimes from an authenticated OCI repository. A local user can read the token file to disclose OCI authentication tokens.

The issue is relevant to apps, runtimes, or extensions downloaded from OCI repositories.

Flatpak
Debian Linux
Anolis OS
flatpak
flatpak-devel
flatpak-libs
flatpak-session-helper
flatpak-tests
flatpak-doc
flatpak-selinux
flatpak (Debian package)

Install security update from vendor's website.

Flatpak - update to 1.18.4
flatpak - update to 1.18.4-1
flatpak-devel - update to 1.18.4-1
flatpak-libs - update to 1.18.4-1
flatpak-session-helper - update to 1.18.4-1
flatpak-tests - update to 1.18.4-1
flatpak-doc - update to 1.18.4-1
flatpak-selinux - update to 1.18.4-1
flatpak (Debian package) - update to 1.16.6-1~deb13u3

• https://github.com/flatpak/flatpak/security/advisories/GHSA-7rvf-rqr3-43j4
• https://github.com/flatpak/flatpak/commit/f911bbf080e33b2b85c9dd6ea0a59898f969497c

• Multiple vulnerabilities in Flatpak
• Anolis OS update for flatpak
• Debian update for flatpak