Red Hat Product Errata RHSA-2026:80496 - Security Advisory
Issued:
2026-10-12
Updated:
2026-10-12

RHSA-2026:80496 - Security Advisory

Synopsis

Important: flatpak-builder security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for flatpak-builder is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Flatpak-builder is a tool for building flatpaks from sources.

Security Fix(es):

  • flatpak-builder: Host code execution via `git am` hook execution in patch source extraction (`use-git-am`) (CVE-2026-86320)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 9 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 9 aarch64
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64
  • Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64
  • Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x
  • Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64
  • Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64
  • Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le
  • Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x

Fixes

  • BZ - 2471023 - CVE-2026-86320 flatpak-builder: Host code execution via `git am` hook execution in patch source extraction (`use-git-am`)

Red Hat Enterprise Linux for x86_64 9

SRPM
flatpak-builder-1.2.3-1.el9_8.1.src.rpm SHA-256: 9d8ee515a7f721c58407a5057ab76186d106e990f203c521ad5bcb4b4724be33
x86_64
flatpak-builder-1.2.3-1.el9_8.1.x86_64.rpm SHA-256: 33ef9ceb4c6432630f9c3266c52bc89d4861434acf9a802378a85110a34cd8e5
flatpak-builder-debuginfo-1.2.3-1.el9_8.1.x86_64.rpm SHA-256: bd8f8e824894bef2c03181c1fbef7560636ff4a68b2801c76658dc55e1f7a19e
flatpak-builder-debugsource-1.2.3-1.el9_8.1.x86_64.rpm SHA-256: 8e8c80c7e1213194a024be6d92d8007e150ff68ce6c9c5b7f0a1a4cd1bdb20d8

Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8

SRPM
flatpak-builder-1.2.3-1.el9_8.1.src.rpm SHA-256: 9d8ee515a7f721c58407a5057ab76186d106e990f203c521ad5bcb4b4724be33
x86_64
flatpak-builder-1.2.3-1.el9_8.1.x86_64.rpm SHA-256: 33ef9ceb4c6432630f9c3266c52bc89d4861434acf9a802378a85110a34cd8e5
flatpak-builder-debuginfo-1.2.3-1.el9_8.1.x86_64.rpm SHA-256: bd8f8e824894bef2c03181c1fbef7560636ff4a68b2801c76658dc55e1f7a19e
flatpak-builder-debugsource-1.2.3-1.el9_8.1.x86_64.rpm SHA-256: 8e8c80c7e1213194a024be6d92d8007e150ff68ce6c9c5b7f0a1a4cd1bdb20d8

Red Hat Enterprise Linux for IBM z Systems 9

SRPM
flatpak-builder-1.2.3-1.el9_8.1.src.rpm SHA-256: 9d8ee515a7f721c58407a5057ab76186d106e990f203c521ad5bcb4b4724be33
s390x
flatpak-builder-1.2.3-1.el9_8.1.s390x.rpm SHA-256: 75368861915aad086f69c3f8ed655bb9a7445c57f37cb448baa59e3517e1967f
flatpak-builder-debuginfo-1.2.3-1.el9_8.1.s390x.rpm SHA-256: efeb155ce6307cf40dcf4c596eb8eab81c1286ff4d26e2b1a4e9f6b08ee0f522
flatpak-builder-debugsource-1.2.3-1.el9_8.1.s390x.rpm SHA-256: da5a4a8feb323d59dede9998484473ac0c3b76034abc0659f0b2631037065475

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8

SRPM
flatpak-builder-1.2.3-1.el9_8.1.src.rpm SHA-256: 9d8ee515a7f721c58407a5057ab76186d106e990f203c521ad5bcb4b4724be33
s390x
flatpak-builder-1.2.3-1.el9_8.1.s390x.rpm SHA-256: 75368861915aad086f69c3f8ed655bb9a7445c57f37cb448baa59e3517e1967f
flatpak-builder-debuginfo-1.2.3-1.el9_8.1.s390x.rpm SHA-256: efeb155ce6307cf40dcf4c596eb8eab81c1286ff4d26e2b1a4e9f6b08ee0f522
flatpak-builder-debugsource-1.2.3-1.el9_8.1.s390x.rpm SHA-256: da5a4a8feb323d59dede9998484473ac0c3b76034abc0659f0b2631037065475

Red Hat Enterprise Linux for Power, little endian 9

SRPM
flatpak-builder-1.2.3-1.el9_8.1.src.rpm SHA-256: 9d8ee515a7f721c58407a5057ab76186d106e990f203c521ad5bcb4b4724be33
ppc64le
flatpak-builder-1.2.3-1.el9_8.1.ppc64le.rpm SHA-256: e043c6637a8b211ec616fe246671e3d4c445012c04ca5cfa12e2a4fea1d30068
flatpak-builder-debuginfo-1.2.3-1.el9_8.1.ppc64le.rpm SHA-256: 2e41a3701058d3d5ad4a56600b2d053c5d9d94577299e2d89e1914811d24df94
flatpak-builder-debugsource-1.2.3-1.el9_8.1.ppc64le.rpm SHA-256: 1e5bd9fa14c67a9a481f577c5349b87ed1c43a18d88135612a21fdaeabec1acc

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8

SRPM
flatpak-builder-1.2.3-1.el9_8.1.src.rpm SHA-256: 9d8ee515a7f721c58407a5057ab76186d106e990f203c521ad5bcb4b4724be33
ppc64le
flatpak-builder-1.2.3-1.el9_8.1.ppc64le.rpm SHA-256: e043c6637a8b211ec616fe246671e3d4c445012c04ca5cfa12e2a4fea1d30068
flatpak-builder-debuginfo-1.2.3-1.el9_8.1.ppc64le.rpm SHA-256: 2e41a3701058d3d5ad4a56600b2d053c5d9d94577299e2d89e1914811d24df94
flatpak-builder-debugsource-1.2.3-1.el9_8.1.ppc64le.rpm SHA-256: 1e5bd9fa14c67a9a481f577c5349b87ed1c43a18d88135612a21fdaeabec1acc

Red Hat Enterprise Linux for ARM 64 9

SRPM
flatpak-builder-1.2.3-1.el9_8.1.src.rpm SHA-256: 9d8ee515a7f721c58407a5057ab76186d106e990f203c521ad5bcb4b4724be33
aarch64
flatpak-builder-1.2.3-1.el9_8.1.aarch64.rpm SHA-256: 2bee8b8eb54c0e86628fb66332b2172bd991179058542197b9b63763deeac696
flatpak-builder-debuginfo-1.2.3-1.el9_8.1.aarch64.rpm SHA-256: be5a17390e7adb6d8f93d10391a6a2512482ca2bebc5a1cac7243c4bbec90c03
flatpak-builder-debugsource-1.2.3-1.el9_8.1.aarch64.rpm SHA-256: 342d37479f4671da6c007122ad9fe55d97ca58e5b25a62a9fb2759775470aacd

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8

SRPM
flatpak-builder-1.2.3-1.el9_8.1.src.rpm SHA-256: 9d8ee515a7f721c58407a5057ab76186d106e990f203c521ad5bcb4b4724be33
aarch64
flatpak-builder-1.2.3-1.el9_8.1.aarch64.rpm SHA-256: 2bee8b8eb54c0e86628fb66332b2172bd991179058542197b9b63763deeac696
flatpak-builder-debuginfo-1.2.3-1.el9_8.1.aarch64.rpm SHA-256: be5a17390e7adb6d8f93d10391a6a2512482ca2bebc5a1cac7243c4bbec90c03
flatpak-builder-debugsource-1.2.3-1.el9_8.1.aarch64.rpm SHA-256: 342d37479f4671da6c007122ad9fe55d97ca58e5b25a62a9fb2759775470aacd

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8

SRPM
flatpak-builder-1.2.3-1.el9_8.1.src.rpm SHA-256: 9d8ee515a7f721c58407a5057ab76186d106e990f203c521ad5bcb4b4724be33
ppc64le
flatpak-builder-1.2.3-1.el9_8.1.ppc64le.rpm SHA-256: e043c6637a8b211ec616fe246671e3d4c445012c04ca5cfa12e2a4fea1d30068
flatpak-builder-debuginfo-1.2.3-1.el9_8.1.ppc64le.rpm SHA-256: 2e41a3701058d3d5ad4a56600b2d053c5d9d94577299e2d89e1914811d24df94
flatpak-builder-debugsource-1.2.3-1.el9_8.1.ppc64le.rpm SHA-256: 1e5bd9fa14c67a9a481f577c5349b87ed1c43a18d88135612a21fdaeabec1acc

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8

SRPM
flatpak-builder-1.2.3-1.el9_8.1.src.rpm SHA-256: 9d8ee515a7f721c58407a5057ab76186d106e990f203c521ad5bcb4b4724be33
x86_64
flatpak-builder-1.2.3-1.el9_8.1.x86_64.rpm SHA-256: 33ef9ceb4c6432630f9c3266c52bc89d4861434acf9a802378a85110a34cd8e5
flatpak-builder-debuginfo-1.2.3-1.el9_8.1.x86_64.rpm SHA-256: bd8f8e824894bef2c03181c1fbef7560636ff4a68b2801c76658dc55e1f7a19e
flatpak-builder-debugsource-1.2.3-1.el9_8.1.x86_64.rpm SHA-256: 8e8c80c7e1213194a024be6d92d8007e150ff68ce6c9c5b7f0a1a4cd1bdb20d8

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8

SRPM
flatpak-builder-1.2.3-1.el9_8.1.src.rpm SHA-256: 9d8ee515a7f721c58407a5057ab76186d106e990f203c521ad5bcb4b4724be33
aarch64
flatpak-builder-1.2.3-1.el9_8.1.aarch64.rpm SHA-256: 2bee8b8eb54c0e86628fb66332b2172bd991179058542197b9b63763deeac696
flatpak-builder-debuginfo-1.2.3-1.el9_8.1.aarch64.rpm SHA-256: be5a17390e7adb6d8f93d10391a6a2512482ca2bebc5a1cac7243c4bbec90c03
flatpak-builder-debugsource-1.2.3-1.el9_8.1.aarch64.rpm SHA-256: 342d37479f4671da6c007122ad9fe55d97ca58e5b25a62a9fb2759775470aacd

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8

SRPM
flatpak-builder-1.2.3-1.el9_8.1.src.rpm SHA-256: 9d8ee515a7f721c58407a5057ab76186d106e990f203c521ad5bcb4b4724be33
s390x
flatpak-builder-1.2.3-1.el9_8.1.s390x.rpm SHA-256: 75368861915aad086f69c3f8ed655bb9a7445c57f37cb448baa59e3517e1967f
flatpak-builder-debuginfo-1.2.3-1.el9_8.1.s390x.rpm SHA-256: efeb155ce6307cf40dcf4c596eb8eab81c1286ff4d26e2b1a4e9f6b08ee0f522
flatpak-builder-debugsource-1.2.3-1.el9_8.1.s390x.rpm SHA-256: da5a4a8feb323d59dede9998484473ac0c3b76034abc0659f0b2631037065475

Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8

SRPM
flatpak-builder-1.2.3-1.el9_8.1.src.rpm SHA-256: 9d8ee515a7f721c58407a5057ab76186d106e990f203c521ad5bcb4b4724be33
x86_64
flatpak-builder-1.2.3-1.el9_8.1.x86_64.rpm SHA-256: 33ef9ceb4c6432630f9c3266c52bc89d4861434acf9a802378a85110a34cd8e5
flatpak-builder-debuginfo-1.2.3-1.el9_8.1.x86_64.rpm SHA-256: bd8f8e824894bef2c03181c1fbef7560636ff4a68b2801c76658dc55e1f7a19e
flatpak-builder-debugsource-1.2.3-1.el9_8.1.x86_64.rpm SHA-256: 8e8c80c7e1213194a024be6d92d8007e150ff68ce6c9c5b7f0a1a4cd1bdb20d8

Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8

SRPM
flatpak-builder-1.2.3-1.el9_8.1.src.rpm SHA-256: 9d8ee515a7f721c58407a5057ab76186d106e990f203c521ad5bcb4b4724be33
aarch64
flatpak-builder-1.2.3-1.el9_8.1.aarch64.rpm SHA-256: 2bee8b8eb54c0e86628fb66332b2172bd991179058542197b9b63763deeac696
flatpak-builder-debuginfo-1.2.3-1.el9_8.1.aarch64.rpm SHA-256: be5a17390e7adb6d8f93d10391a6a2512482ca2bebc5a1cac7243c4bbec90c03
flatpak-builder-debugsource-1.2.3-1.el9_8.1.aarch64.rpm SHA-256: 342d37479f4671da6c007122ad9fe55d97ca58e5b25a62a9fb2759775470aacd

Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8

SRPM
flatpak-builder-1.2.3-1.el9_8.1.src.rpm SHA-256: 9d8ee515a7f721c58407a5057ab76186d106e990f203c521ad5bcb4b4724be33
ppc64le
flatpak-builder-1.2.3-1.el9_8.1.ppc64le.rpm SHA-256: e043c6637a8b211ec616fe246671e3d4c445012c04ca5cfa12e2a4fea1d30068
flatpak-builder-debuginfo-1.2.3-1.el9_8.1.ppc64le.rpm SHA-256: 2e41a3701058d3d5ad4a56600b2d053c5d9d94577299e2d89e1914811d24df94
flatpak-builder-debugsource-1.2.3-1.el9_8.1.ppc64le.rpm SHA-256: 1e5bd9fa14c67a9a481f577c5349b87ed1c43a18d88135612a21fdaeabec1acc

Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8

SRPM
flatpak-builder-1.2.3-1.el9_8.1.src.rpm SHA-256: 9d8ee515a7f721c58407a5057ab76186d106e990f203c521ad5bcb4b4724be33
s390x
flatpak-builder-1.2.3-1.el9_8.1.s390x.rpm SHA-256: 75368861915aad086f69c3f8ed655bb9a7445c57f37cb448baa59e3517e1967f
flatpak-builder-debuginfo-1.2.3-1.el9_8.1.s390x.rpm SHA-256: efeb155ce6307cf40dcf4c596eb8eab81c1286ff4d26e2b1a4e9f6b08ee0f522
flatpak-builder-debugsource-1.2.3-1.el9_8.1.s390x.rpm SHA-256: da5a4a8feb323d59dede9998484473ac0c3b76034abc0659f0b2631037065475

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.