CVE-2026-97025

Name of the Vulnerable Software and Affected Versions Flatpak (affected versions not specified)

Description Flatpak writes the OCI (Open Container Initiative) repository authentication token with world-readable permissions (0644) in the system-helper's cache directory. This allows other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. This issue only affects OCI-based sources, such as those used by Fedora, while libostree-based sources like Flathub are not affected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.