CVE-2026-34078: Critical Flatpak Sandbox Escape Lets Any App Read Arbitrary Host Files — Patch to 1.16.4 Now

Flatpak 1.16.4 is out and it fixes CVE-2026-34078, a critical sandbox escape that allows any installed Flatpak application to read arbitrary files on the host system and achieve code execution outside the container boundary. If you run Flatpak on any Linux distribution, update now.

The vulnerability. The flaw lives in how the Flatpak portal handles --sandbox-expose options. The portal accepted app-controlled symlinks inside sandbox-expose paths without validating where those symlinks resolved to on the host. A sandboxed app could craft a symlink pointing to /etc/shadow, /root/.ssh/id_rsa, or any other host-level path, pass it through a portal request, and receive the real file contents — completely bypassing the sandbox isolation that is Flatpak’s core security guarantee.

From there, depending on what the app retrieves and which binaries are reachable, full code execution in the host context is achievable. The attack is local but does not require elevated privileges inside the sandbox — any sandboxed app, including one installed from Flathub by an unprivileged user, can trigger it.

Severity and scope. No CVSS score has been published at the time of writing, but the combination of sandbox bypass + arbitrary file read + host code execution path puts this firmly in the critical range. All Flatpak versions prior to 1.16.4 are affected. The 1.16.4 release also fixes three additional CVEs (identifiers pending), making this a multi-flaw security release rather than a single-issue patch.

How to patch. Most major distributions ship Flatpak through their official package manager. The correct command depends on your distro:

# Fedora / RHEL / CentOS Stream
sudo dnf upgrade flatpak

# Ubuntu / Debian
sudo apt update && sudo apt upgrade flatpak

# Arch Linux
sudo pacman -Syu flatpak

# openSUSE
sudo zypper update flatpak

Verify you are on 1.16.4 or later with flatpak --version.

Why this matters beyond the patch. Flatpak is the dominant sandboxed packaging format on Linux desktops. It underpins how software is distributed on GNOME-based desktops, Steam Deck, and an increasing number of enterprise Linux workstations. A sandbox escape that any installed app can trigger silently undermines the entire security model users have been told to rely on. The fact that apps on Flathub run with reduced host privileges is precisely the trust guarantee that makes centralized distribution viable — and CVE-2026-34078 punches through that guarantee completely.

Security teams managing Linux fleets should treat this as a critical patch cycle, not a routine update. Audit your Flatpak installations, enforce version policies, and consider restricting Flathub installs to reviewed app IDs on sensitive systems until the patch is confirmed deployed.