CVE-2026-93676
Fixed in a distro release EPSS <1%CVSS 3.2
xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted, potentially exposing sensitive information to unauthorized applications.
Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 13 | xdg-dbus-proxy | 0.1.6-1+deb13u2 |
| Debian 14 | xdg-dbus-proxy | 0.1.8-1 |
| Ubuntu 22.04 LTS | xdg-dbus-proxy | no fix |
| Ubuntu 24.04 LTS | xdg-dbus-proxy | no fix |
| Ubuntu 26.04 LTS | xdg-dbus-proxy | no fix |
| Ubuntu Pro 20.04 LTS | xdg-dbus-proxy | no fix |
| openSUSE Tumbleweed | flatpak | 1.18.3-1.1 |
| openSUSE Tumbleweed | xdg-dbus-proxy | 0.1.9-1.1 |