Flatpak contains two vulnerabilities: CVE-2026-34078 enables arbitrary code execution through crafted symbolic links in sandbox-expose options, and CVE-2026-34079 allows arbitrary file deletion on the host system due to improper validation of cache file paths. Both vulnerabilities affect multiple Red Hat Enterprise Linux 10 variants and related CodeReady Linux Builder products. Red Hat has issued security advisories and updates to fix these vulnerabilities. The advisory references Bugzilla entries BZ-2456276 and BZ-2456284 for the respective CVEs. No CVSS scores are provided in the advisory, but the severity is rated as Important.

Successful exploitation of CVE-2026-34078 could allow an attacker to execute arbitrary code within the Flatpak sandbox environment, potentially leading to unauthorized actions. CVE-2026-34079 could enable deletion of arbitrary files on the host system, which may result in data loss or system instability. Both vulnerabilities pose significant risks to affected systems running Flatpak on Red Hat Enterprise Linux 10 and related products.

Red Hat has released security updates for Flatpak that address these vulnerabilities. Users should apply the updates as described in the Red Hat advisory RHSA-2026:21757 and the referenced article https://access.redhat.com/articles/11258. Since this is an on-premises product, remediation requires manual update application. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated beyond applying the official updates.