# CVE-2026-34080: Flatpak xdg-dbus-proxy policy parser bypass in eavesdrop restrictions

Source: https://junglewise.ai/threats/cve-2026-34080-flatpak-xdg-dbus-proxy-policy-parser-bypass-in-eavesdrop  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-07. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-34080 · Severity: medium · CVSS 5.5 · Published 2026-04-07

xdg-dbus-proxy is a tool used to filter and secure communications between different applications on a Linux system, commonly used within Flatpak environments. A flaw in how it processes security rules allows a malicious or compromised application to bypass restrictions and 'eavesdrop' on private system messages. This could lead to the unauthorized interception of sensitive data being exchanged between other running programs.

Vendors: [Flatpak](https://junglewise.ai/threats/vendors/flatpak).

## Quick answers

**Is CVE-2026-34080 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34080 being exploited in the wild.

**How severe is CVE-2026-34080?** Medium severity, with a CVSS score of 5.5, published 7 April 2026.

**Which products and versions are affected?** Flatpak Xdg-Dbus-Proxy < 0.1.7.

**Is there a fix for CVE-2026-34080?** A patch was published on 2026-04-07: Fixed in version 0.1.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34080 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-34080?** Check whether you run Flatpak Xdg-Dbus-Proxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the policy parser of xdg-dbus-proxy due to improper validation of unsafe equivalence in input (CWE-1289). The proxy specifically checks for the string 'eavesdrop=true' in policy rules but fails to account for variations such as 'eavesdrop = \'true\'' (containing spaces or different quoting). A local attacker, typically a malicious or compromised Flatpak application, can exploit this parsing inconsistency to bypass eavesdropping restrictions. This allows the attacker to monitor and intercept D-Bus messages on the session bus that should be restricted. The issue is resolved in version 0.1.7.

## Affected products

- flatpak xdg-dbus-proxy < 0.1.7

## Timeline

- 2026-04-07: disclosed
- 2026-04-07: advisory: Vendor advisory published by Flatpak
- 2026-04-07: patched: Fixed in version 0.1.7
- 2026-04-21: advisory: Debian LTS advisory DLA-4542-1 published

## References

- [https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-vjp5-hjfm-7677](https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-vjp5-hjfm-7677)
- [http://www.openwall.com/lists/oss-security/2026/04/10/15](http://www.openwall.com/lists/oss-security/2026/04/10/15)
- [https://lists.debian.org/debian-lts-announce/2026/04/msg00022.html](https://lists.debian.org/debian-lts-announce/2026/04/msg00022.html)

## Related threats

- [xdg-dbus-proxy message filtering bypass in D-Bus proxy](https://junglewise.ai/threats/cve-2026-94422-an-incorrect-implementation-of-message-filtering-in-xdg-dbus)