Flatpak 1.16.4 Addresses Critical Security Flaws Including Sandbox Escape

Severity: High (Score: 70.5)

Sources: Feeds2.Feedburner, Phoronix

Summary

Flatpak released version 1.16.4 on April 8, 2026, fixing four security vulnerabilities. The most critical issue, CVE-2026-34078, allows a complete sandbox escape, enabling unauthorized host file access and code execution. Two additional vulnerabilities, CVE-2026-34079 and GHSA-2fxp-43j9-pwvc, address file system exposure, preventing arbitrary file deletion and read-access on the host filesystem. These vulnerabilities affect users of the Flatpak framework, which is widely used for Linux application distribution. The fixes are now available, and users are urged to update their systems to mitigate these risks. The vulnerabilities were published on April 7, 2026, indicating a prompt response from the Flatpak team. The potential impact of these vulnerabilities is significant, given the critical nature of the sandbox escape. Current status is that the vulnerabilities have been patched, but users must take action to secure their systems. Key Points: • Flatpak 1.16.4 fixes four security vulnerabilities, including a critical sandbox escape. • CVE-2026-34078 allows host file access and code execution, posing a severe risk. • Users are urged to update to version 1.16.4 to mitigate these vulnerabilities.

Key Entities

• CVE-2026-34078 (cve)
• CVE-2026-34079 (cve)
• michaellarabel.com (domain)
• openbenchmarking.org (domain)
• phoronix.com (domain)
• Linux (platform)