Flatpak versions included in Red Hat Enterprise Linux 8 and related distributions contain two vulnerabilities: CVE-2026-34078 enables arbitrary code execution through crafted symlinks in sandbox-expose options, and CVE-2026-34079 allows arbitrary file deletion on the host system due to improper validation of cache file paths. Red Hat Product Security has released an update (flatpak-1.12.9-4.el8_10) that fixes these issues. The advisory RHSA-2026:21756 details the update and affected packages across multiple architectures. No CVSS score is provided in the advisory, but the severity is rated as Important by Red Hat.

Successful exploitation of CVE-2026-34078 could allow an attacker to execute arbitrary code within the Flatpak sandbox environment, potentially leading to elevated privileges or system compromise. CVE-2026-34079 could enable an attacker to delete arbitrary files on the host system, potentially disrupting system operations or causing data loss. Both vulnerabilities pose significant risks to affected systems running Flatpak on Red Hat Enterprise Linux 8.

Red Hat has released an official security update for Flatpak (version 1.12.9-4.el8_10) that addresses these vulnerabilities. Users of Red Hat Enterprise Linux 8 and related distributions should apply this update promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patch.