Issued:: 2026-10-19
Updated:: 2026-10-19

RHSA-2026:84833 - Security Advisory

Overview
Updated Packages

Synopsis

Important: flatpak-builder security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for flatpak-builder is now available for Red Hat Enterprise Linux 9.6 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Flatpak-builder is a tool for building flatpaks from sources.

Security Fix(es):

flatpak-builder: Host code execution via `git am` hook execution in patch source extraction (`use-git-am`) (CVE-2026-86320)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 x86_64
Red Hat Enterprise Linux Server - AUS 9.6 x86_64
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 s390x
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 ppc64le
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 aarch64
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 ppc64le
Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 x86_64
Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 aarch64
Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 s390x
Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6 x86_64
Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6 aarch64
Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6 ppc64le
Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.6 s390x

Fixes

BZ - 2471023 - CVE-2026-86320 flatpak-builder: Host code execution via `git am` hook execution in patch source extraction (`use-git-am`)

CVEs

CVE-2026-86320

References

https://access.redhat.com/security/updates/classification/#important

Note: More recent versions of these packages may be available. Click a package name for more details.

Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6

SRPM
flatpak-builder-1.2.3-1.el9_6.1.src.rpm	SHA-256: c6a8c0870692104549b0bd0b2805413a26ed08662f6a8be14b1ea401d2c97061
x86_64
flatpak-builder-1.2.3-1.el9_6.1.x86_64.rpm	SHA-256: e78bf7af8eeb17a038d96f930770fb9989fb1766f9fd6c11f2112214b0090ff3
flatpak-builder-debuginfo-1.2.3-1.el9_6.1.x86_64.rpm	SHA-256: 1619d90bfbc34284aed41f019d5c51ab9a33fc029894c59f31417ab9e10c4727
flatpak-builder-debugsource-1.2.3-1.el9_6.1.x86_64.rpm	SHA-256: 29cfc8c642be1e96df9fcb3ea9a2f2a27fd2ca75bb316f42395309ad5560d7db

Red Hat Enterprise Linux Server - AUS 9.6

SRPM
flatpak-builder-1.2.3-1.el9_6.1.src.rpm	SHA-256: c6a8c0870692104549b0bd0b2805413a26ed08662f6a8be14b1ea401d2c97061
x86_64
flatpak-builder-1.2.3-1.el9_6.1.x86_64.rpm	SHA-256: e78bf7af8eeb17a038d96f930770fb9989fb1766f9fd6c11f2112214b0090ff3
flatpak-builder-debuginfo-1.2.3-1.el9_6.1.x86_64.rpm	SHA-256: 1619d90bfbc34284aed41f019d5c51ab9a33fc029894c59f31417ab9e10c4727
flatpak-builder-debugsource-1.2.3-1.el9_6.1.x86_64.rpm	SHA-256: 29cfc8c642be1e96df9fcb3ea9a2f2a27fd2ca75bb316f42395309ad5560d7db

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6

SRPM
flatpak-builder-1.2.3-1.el9_6.1.src.rpm	SHA-256: c6a8c0870692104549b0bd0b2805413a26ed08662f6a8be14b1ea401d2c97061
s390x
flatpak-builder-1.2.3-1.el9_6.1.s390x.rpm	SHA-256: c7246a0dfda33418c7ae3ad4e4ac15c2ec3080719a814fdaa60671965eac7e4e
flatpak-builder-debuginfo-1.2.3-1.el9_6.1.s390x.rpm	SHA-256: ad67fd5759e484e010681ad1482c4a873e92705a65742ad175a0dd738f31ba65
flatpak-builder-debugsource-1.2.3-1.el9_6.1.s390x.rpm	SHA-256: 840077a21e8918e6fd0f8153800e572006bd5ca95d2dd1a12cd1ca51a04fd8c7

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6

SRPM
flatpak-builder-1.2.3-1.el9_6.1.src.rpm	SHA-256: c6a8c0870692104549b0bd0b2805413a26ed08662f6a8be14b1ea401d2c97061
ppc64le
flatpak-builder-1.2.3-1.el9_6.1.ppc64le.rpm	SHA-256: da909373fc5cc30ba047af9572a02a7e3677c641c26a8474868b35072dce9d1f
flatpak-builder-debuginfo-1.2.3-1.el9_6.1.ppc64le.rpm	SHA-256: b61d9e200d617e246a0da474a4a19deeda4bc15b6e0e2b8c5203e98e79804a01
flatpak-builder-debugsource-1.2.3-1.el9_6.1.ppc64le.rpm	SHA-256: 5327ab7412bc4d232d85784b6efb71baa96852c9e8da74c8b2979763d8306396

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6

SRPM
flatpak-builder-1.2.3-1.el9_6.1.src.rpm	SHA-256: c6a8c0870692104549b0bd0b2805413a26ed08662f6a8be14b1ea401d2c97061
aarch64
flatpak-builder-1.2.3-1.el9_6.1.aarch64.rpm	SHA-256: 8154b3eef19dd6c153358ab0c294c13541af3e326f292d2c276bb65d96f1a454
flatpak-builder-debuginfo-1.2.3-1.el9_6.1.aarch64.rpm	SHA-256: 600288430f41304051d1ce3c5b7f1bab55d15d735f5c066cb0493a0edba494e2
flatpak-builder-debugsource-1.2.3-1.el9_6.1.aarch64.rpm	SHA-256: 4987cbaa0bbfa58ecbd587c3514515b4d906e244c0fb01eb681fec99d52bc469

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6

SRPM
flatpak-builder-1.2.3-1.el9_6.1.src.rpm	SHA-256: c6a8c0870692104549b0bd0b2805413a26ed08662f6a8be14b1ea401d2c97061
ppc64le
flatpak-builder-1.2.3-1.el9_6.1.ppc64le.rpm	SHA-256: da909373fc5cc30ba047af9572a02a7e3677c641c26a8474868b35072dce9d1f
flatpak-builder-debuginfo-1.2.3-1.el9_6.1.ppc64le.rpm	SHA-256: b61d9e200d617e246a0da474a4a19deeda4bc15b6e0e2b8c5203e98e79804a01
flatpak-builder-debugsource-1.2.3-1.el9_6.1.ppc64le.rpm	SHA-256: 5327ab7412bc4d232d85784b6efb71baa96852c9e8da74c8b2979763d8306396

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6

SRPM
flatpak-builder-1.2.3-1.el9_6.1.src.rpm	SHA-256: c6a8c0870692104549b0bd0b2805413a26ed08662f6a8be14b1ea401d2c97061
x86_64
flatpak-builder-1.2.3-1.el9_6.1.x86_64.rpm	SHA-256: e78bf7af8eeb17a038d96f930770fb9989fb1766f9fd6c11f2112214b0090ff3
flatpak-builder-debuginfo-1.2.3-1.el9_6.1.x86_64.rpm	SHA-256: 1619d90bfbc34284aed41f019d5c51ab9a33fc029894c59f31417ab9e10c4727
flatpak-builder-debugsource-1.2.3-1.el9_6.1.x86_64.rpm	SHA-256: 29cfc8c642be1e96df9fcb3ea9a2f2a27fd2ca75bb316f42395309ad5560d7db

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6

SRPM
flatpak-builder-1.2.3-1.el9_6.1.src.rpm	SHA-256: c6a8c0870692104549b0bd0b2805413a26ed08662f6a8be14b1ea401d2c97061
aarch64
flatpak-builder-1.2.3-1.el9_6.1.aarch64.rpm	SHA-256: 8154b3eef19dd6c153358ab0c294c13541af3e326f292d2c276bb65d96f1a454
flatpak-builder-debuginfo-1.2.3-1.el9_6.1.aarch64.rpm	SHA-256: 600288430f41304051d1ce3c5b7f1bab55d15d735f5c066cb0493a0edba494e2
flatpak-builder-debugsource-1.2.3-1.el9_6.1.aarch64.rpm	SHA-256: 4987cbaa0bbfa58ecbd587c3514515b4d906e244c0fb01eb681fec99d52bc469

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6

SRPM
flatpak-builder-1.2.3-1.el9_6.1.src.rpm	SHA-256: c6a8c0870692104549b0bd0b2805413a26ed08662f6a8be14b1ea401d2c97061
s390x
flatpak-builder-1.2.3-1.el9_6.1.s390x.rpm	SHA-256: c7246a0dfda33418c7ae3ad4e4ac15c2ec3080719a814fdaa60671965eac7e4e
flatpak-builder-debuginfo-1.2.3-1.el9_6.1.s390x.rpm	SHA-256: ad67fd5759e484e010681ad1482c4a873e92705a65742ad175a0dd738f31ba65
flatpak-builder-debugsource-1.2.3-1.el9_6.1.s390x.rpm	SHA-256: 840077a21e8918e6fd0f8153800e572006bd5ca95d2dd1a12cd1ca51a04fd8c7

Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6

SRPM
flatpak-builder-1.2.3-1.el9_6.1.src.rpm	SHA-256: c6a8c0870692104549b0bd0b2805413a26ed08662f6a8be14b1ea401d2c97061
x86_64
flatpak-builder-1.2.3-1.el9_6.1.x86_64.rpm	SHA-256: e78bf7af8eeb17a038d96f930770fb9989fb1766f9fd6c11f2112214b0090ff3
flatpak-builder-debuginfo-1.2.3-1.el9_6.1.x86_64.rpm	SHA-256: 1619d90bfbc34284aed41f019d5c51ab9a33fc029894c59f31417ab9e10c4727
flatpak-builder-debugsource-1.2.3-1.el9_6.1.x86_64.rpm	SHA-256: 29cfc8c642be1e96df9fcb3ea9a2f2a27fd2ca75bb316f42395309ad5560d7db

Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6

SRPM
flatpak-builder-1.2.3-1.el9_6.1.src.rpm	SHA-256: c6a8c0870692104549b0bd0b2805413a26ed08662f6a8be14b1ea401d2c97061
aarch64
flatpak-builder-1.2.3-1.el9_6.1.aarch64.rpm	SHA-256: 8154b3eef19dd6c153358ab0c294c13541af3e326f292d2c276bb65d96f1a454
flatpak-builder-debuginfo-1.2.3-1.el9_6.1.aarch64.rpm	SHA-256: 600288430f41304051d1ce3c5b7f1bab55d15d735f5c066cb0493a0edba494e2
flatpak-builder-debugsource-1.2.3-1.el9_6.1.aarch64.rpm	SHA-256: 4987cbaa0bbfa58ecbd587c3514515b4d906e244c0fb01eb681fec99d52bc469

Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6

SRPM
flatpak-builder-1.2.3-1.el9_6.1.src.rpm	SHA-256: c6a8c0870692104549b0bd0b2805413a26ed08662f6a8be14b1ea401d2c97061
ppc64le
flatpak-builder-1.2.3-1.el9_6.1.ppc64le.rpm	SHA-256: da909373fc5cc30ba047af9572a02a7e3677c641c26a8474868b35072dce9d1f
flatpak-builder-debuginfo-1.2.3-1.el9_6.1.ppc64le.rpm	SHA-256: b61d9e200d617e246a0da474a4a19deeda4bc15b6e0e2b8c5203e98e79804a01
flatpak-builder-debugsource-1.2.3-1.el9_6.1.ppc64le.rpm	SHA-256: 5327ab7412bc4d232d85784b6efb71baa96852c9e8da74c8b2979763d8306396

Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.6

SRPM
flatpak-builder-1.2.3-1.el9_6.1.src.rpm	SHA-256: c6a8c0870692104549b0bd0b2805413a26ed08662f6a8be14b1ea401d2c97061
s390x
flatpak-builder-1.2.3-1.el9_6.1.s390x.rpm	SHA-256: c7246a0dfda33418c7ae3ad4e4ac15c2ec3080719a814fdaa60671965eac7e4e
flatpak-builder-debuginfo-1.2.3-1.el9_6.1.s390x.rpm	SHA-256: ad67fd5759e484e010681ad1482c4a873e92705a65742ad175a0dd738f31ba65
flatpak-builder-debugsource-1.2.3-1.el9_6.1.s390x.rpm	SHA-256: 840077a21e8918e6fd0f8153800e572006bd5ca95d2dd1a12cd1ca51a04fd8c7

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.

Select Your Language

Infrastructure and Management

Cloud Computing

Storage

Runtimes

Integration and Automation