Public vulnerability disclosure
CVE-2026-86320
Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)
publishedCWE-94
A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.
Technical severity7.8 highCVSS 3.1 · CNA: redhat
Published2026-09-17Source updated 2026-11-11
Collected2026-11-112 attributed sources
Fixes and workarounds
Workaround
Avoid using use-git-am: true when processing untrusted manifests or source material. Where untrusted builds are required, perform builds inside disposable virtual machines or other isolated environments.
Source: CNA: redhatAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| Red Hat Enterprise Linux 10 Red Hat flatpak-builder
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.4.4-1.el10_2.1; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 10 Red Hat flatpak-builder
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.4.7-1.el10_3.1; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 10.0 Extended Update Support Red Hat flatpak-builder
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.4.4-1.el10_0.1; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 8 Red Hat flatpak-builder
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.2.3-2.el8_10; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat flatpak-builder
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.0.9-4.el8_4; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Red Hat flatpak-builder
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.0.9-4.el8_4; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat flatpak-builder
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.0.9-4.el8_6; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Red Hat flatpak-builder
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.0.9-4.el8_6; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 8.8 Telecommunications Update Service Red Hat flatpak-builder
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.0.14-3.el8_8; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat flatpak-builder
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.0.14-3.el8_8; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 9 Red Hat flatpak-builder
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.2.3-1.el9_8.1; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 9 Red Hat flatpak-builder
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.2.3-1.el9_9.1; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Red Hat flatpak-builder
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.2.2-2.el9_2; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Red Hat flatpak-builder
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.2.3-2.el9_4; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 9.6 Extended Update Support Red Hat flatpak-builder
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.2.3-1.el9_6.1; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 3.1 / 7.8 high |
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | CNA: redhat |
Exploit evidence
- https://bugzilla.redhat.com/show_bug.cgi?id=2471023
exploit · ADP: CISA-ADP - https://github.com/flatpak/flatpak-builder/security/advisories/GHSA-j5p8-jgjc-f3xv
exploit · ADP: CISA-ADP
References
- https://access.redhat.com/errata/RHSA-2026:80495CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:80496CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:80973CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:84832CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:84833CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:84834CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:84842CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:86714CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:90896CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:92220CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:98536CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:98642CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-86320CNA: redhat · vdb-entry, x_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2471023CNA: redhat · issue-tracking, x_refsource_REDHAT
- https://github.com/flatpak/flatpak-builder/security/advisories/GHSA-j5p8-jgjc-f3xvCNA: redhat
- https://bugzilla.redhat.com/show_bug.cgi?id=2471023ADP: CISA-ADP · exploit
- https://github.com/flatpak/flatpak-builder/security/advisories/GHSA-j5p8-jgjc-f3xvADP: CISA-ADP · exploit
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.