CVE-2026-96284: Improper Link Resolution Before File Access ('Link Following') in Red Hat Red Hat Enterprise Linux 10
A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control.
AI Analysis
Technical Summary
This vulnerability involves improper link resolution ('link following') in the OCI code paths of the flatpak-system-helper in Red Hat Enterprise Linux 10. When a system OCI repository is configured, a malicious user can exploit this behavior by controlling OCI images that contain symbolic links, allowing read access to files in the flatpak-system-helper context. The issue is classified under CWE-59 and has a CVSS v3.1 score of 2.5, indicating low impact. The vulnerability does not affect integrity or availability and requires local access with low privileges and high attack complexity.
Potential Impact
The impact is limited to unauthorized read access to files within the flatpak-system-helper context. There is no impact on integrity or availability. The vulnerability requires local access with low privileges and high attack complexity, and no user interaction is needed. There are no known exploits in the wild.
Mitigation Recommendations
Red Hat advises removing all OCI system remotes as a mitigation measure. There is no official fix or patch currently stated in the advisory. Users should follow the vendor advisory for updates and consider removing OCI system remotes to reduce risk.
CVE-2026-96284: Improper Link Resolution Before File Access ('Link Following') in Red Hat Red Hat Enterprise Linux 10
Description
A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control.
CVSS v3.1
Score 2.5low
Affected software
Red Hat
Red Hat Enterprise Linux 10
Red Hat
Red Hat Enterprise Linux 7
Red Hat
Red Hat Enterprise Linux 8
Red Hat
Red Hat Enterprise Linux 9
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves improper link resolution ('link following') in the OCI code paths of the flatpak-system-helper in Red Hat Enterprise Linux 10. When a system OCI repository is configured, a malicious user can exploit this behavior by controlling OCI images that contain symbolic links, allowing read access to files in the flatpak-system-helper context. The issue is classified under CWE-59 and has a CVSS v3.1 score of 2.5, indicating low impact. The vulnerability does not affect integrity or availability and requires local access with low privileges and high attack complexity.
Potential Impact
The impact is limited to unauthorized read access to files within the flatpak-system-helper context. There is no impact on integrity or availability. The vulnerability requires local access with low privileges and high attack complexity, and no user interaction is needed. There are no known exploits in the wild.
Mitigation Recommendations
Red Hat advises removing all OCI system remotes as a mitigation measure. There is no official fix or patch currently stated in the advisory. Users should follow the vendor advisory for updates and consider removing OCI system remotes to reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-09-22T20:44:18.585Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-96284","vendor":"Red Hat"}]
Threat ID: 6ab999a9f7a7c541068fe418
Added to database: 09/27/2026, 22:33:13 UTC
Last enriched: 09/27/2026, 22:47:42 UTC
Last updated: 09/28/2026, 01:57:30 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.