Is CVE-2026-55889 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55889 being exploited in the wild.

How severe is CVE-2026-55889?

Informational severity, published 23 October 2026.

Which products and versions are affected?

Flatpak Xdg-Desktop-Portal before 1.22.1.

Is there a fix for CVE-2026-55889?

Yes: fixed in 1.22.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55889 attacked?

It is attacked with local access, in a hosted service.

Am I affected by CVE-2026-55889?

Check whether you run Flatpak Xdg-Desktop-Portal at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55889: XDG Desktop Portal predictable token generation in FileTransfer

CVE-2026-55889 · Severity: info · Published 2026-10-23

XDG Desktop Portal is a system service that manages secure file sharing and clipboard access for sandboxed applications. Prior to version 1.22.1, a malicious sandboxed application can predict security tokens used to control drag-and-drop and copy-paste operations, allowing it to intercept data intended for legitimate applications or gain unauthorized file write access. An attacker with a sandboxed application could steal sensitive data or modify files outside the sandbox.

Technologies: Flatpak Xdg-Desktop-Portal. Vendors: Flatpak.

Quick answers

Is CVE-2026-55889 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55889 being exploited in the wild.
How severe is CVE-2026-55889?: Informational severity, published 23 October 2026.
Which products and versions are affected?: Flatpak Xdg-Desktop-Portal before 1.22.1.
Is there a fix for CVE-2026-55889?: Yes: fixed in 1.22.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55889 attacked?: It is attacked with local access, in a hosted service.
Am I affected by CVE-2026-55889?: Check whether you run Flatpak Xdg-Desktop-Portal at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.22.1

Technical details

The vulnerability stems from use of GLib's GRand (Mersenne Twister PRNG) to generate tokens for FileTransfer.RetrieveFiles and similar methods. An attacker can generate sufficient tokens to recover the PRNG state, then predict future tokens and redirect file transfer operations to itself. This requires the attacker to control a sandboxed application and does not require user interaction beyond normal drag-and-drop or copy-paste.

Affected products

Flatpak XDG Desktop Portal before 1.22.1

Timeline

2026-06-17: disclosed
2026-06-17: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.