Is CVE-2026-34080 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34080 being exploited in the wild.

How severe is CVE-2026-34080?

Medium severity, with a CVSS score of 5.5, published 7 April 2026.

Which products and versions are affected?

Flatpak Xdg-Dbus-Proxy < 0.1.7.

Is there a fix for CVE-2026-34080?

A patch was published on 2026-04-07: Fixed in version 0.1.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34080 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-34080?

Check whether you run Flatpak Xdg-Dbus-Proxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34080: Flatpak xdg-dbus-proxy policy parser bypass in eavesdrop restrictions

Q: Is there a fix for CVE-2026-34080?

A patch was published on 2026-04-07: Fixed in version 0.1.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-34080 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-34080?

Check whether you run Flatpak Xdg-Dbus-Proxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34080 · Severity: medium · CVSS 5.5 · Published 2026-04-07

xdg-dbus-proxy is a tool used to filter and secure communications between different applications on a Linux system, commonly used within Flatpak environments. A flaw in how it processes security rules allows a malicious or compromised application to bypass restrictions and 'eavesdrop' on private system messages. This could lead to the unauthorized interception of sensitive data being exchanged between other running programs.

Vendors: Flatpak.

Quick answers

Is CVE-2026-34080 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34080 being exploited in the wild.
How severe is CVE-2026-34080?: Medium severity, with a CVSS score of 5.5, published 7 April 2026.
Which products and versions are affected?: Flatpak Xdg-Dbus-Proxy < 0.1.7.
Is there a fix for CVE-2026-34080?: A patch was published on 2026-04-07: Fixed in version 0.1.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34080 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-34080?: Check whether you run Flatpak Xdg-Dbus-Proxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the policy parser of xdg-dbus-proxy due to improper validation of unsafe equivalence in input (CWE-1289). The proxy specifically checks for the string 'eavesdrop=true' in policy rules but fails to account for variations such as 'eavesdrop = \'true\'' (containing spaces or different quoting). A local attacker, typically a malicious or compromised Flatpak application, can exploit this parsing inconsistency to bypass eavesdropping restrictions. This allows the attacker to monitor and intercept D-Bus messages on the session bus that should be restricted. The issue is resolved in version 0.1.7.

Affected products

flatpak xdg-dbus-proxy < 0.1.7

Timeline

2026-04-07: disclosed
2026-04-07: advisory: Vendor advisory published by Flatpak
2026-04-07: patched: Fixed in version 0.1.7
2026-04-21: advisory: Debian LTS advisory DLA-4542-1 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.