Xdg-Dbus-Proxy Security Update — AlmaLinux 9 (ALSA-2026:90522)

ALSA-2026:90522 updates xdg-dbus-proxy on AlmaLinux 9, fixing CVE-2026-94422 — an authentication/spoofing flaw (CWE-290) in the D-Bus filtering proxy originally built for Flatpak — rated CVSS 8.8. Servers using Flatpak sandboxes or xdg-dbus-proxy directly should update: dnf update xdg-dbus-proxy.

High 8.8 CVSS 2026-10-27

AlmaLinux 9

Was das unter einer SharedLicense-Lizenz bedeutet

The proxy exists to filter what sandboxed applications may say to D-Bus — an authentication bypass in the filter lets a sandboxed app impersonate or bypass the proxy's rules, reaching host services the sandbox was meant to isolate.

Type:

security

Severity:

important

Release date:

2026-10-27

Description:

xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts.

Security Fix(es):

* xdg-dbus-proxy: xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape (CVE-2026-94422)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	xdg-dbus-proxy-0.1.3-1.el9_8.1.aarch64.rpm	4c50b23b8746a84770f66169b7d6cd2f7cf67114b998e22eca6fb7dbb9527455
ppc64le	xdg-dbus-proxy-0.1.3-1.el9_8.1.ppc64le.rpm	70ad9e81913181a65b0df9a854d774aa56d1542b098a14877e2600dea0661866
s390x	xdg-dbus-proxy-0.1.3-1.el9_8.1.s390x.rpm	138da8cdc66a0fa8c35b4893287d8bcf7eeaf8c78bc3ac3655bb3ccecc141ce9
x86_64	xdg-dbus-proxy-0.1.3-1.el9_8.1.x86_64.rpm	64dbbe7ebb6034ad5775eb3072297ebf1bbe4de611013869092c4de9b94cfc07

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Häufig gestellte Fragen

What is CVE-2026-94422?

It is a vulnerability in xdg-dbus-proxy, the D-Bus filtering proxy from the Flatpak project, classified CWE-290 (authentication bypass by spoofing) and rated CVSS 8.8. Fixed in the AlmaLinux 9 update ALSA-2026:90522.

Who is affected?

AlmaLinux 9 systems using Flatpak sandboxes or applications that invoke xdg-dbus-proxy to filter D-Bus connections — the proxy's whole purpose is sandbox boundary enforcement, so its flaws matter wherever sandboxing is relied upon.

How do I apply the fix?

Run dnf update xdg-dbus-proxy and restart any running sandboxed sessions so the patched proxy is used for new connections.

How severe is a D-Bus proxy bypass?

The proxy is the security boundary between a sandboxed app and host services — defeating its authentication means the sandbox's service-access rules can be spoofed, which is why it carries an 8.8 rating despite being a component few people know by name.

Referenzen

Sicherheitshinweise

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen

Häufig gestellte Fragen

Verwandte Warnhinweise

System auf Schwachstellen prüfen