Flatpak Builder Flaw Lets Malicious Patches Run Code on Red Hat Build Hosts
Red Hat has released errata RHSA-2026:92220, an Important-rated security update for the flatpak-builder package, addressing CVE-2026-86320. Flatpak-builder is the tool used to assemble Flatpak application bundles from source manifests, and the flaw allows code to execute on the host system during patch source extraction when the `use-git-am` option is used. The update applies to Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, specifically Red Hat Enterprise Linux Server AUS 8.4 and Red Hat Enterprise Linux for x86_64 Extended Life Cycle Long Life 8.4 on x86_64. Both advisories and the Bugzilla tracker BZ-2471023 were published on 29 October 2026. Any organisation building Flatpak packages on these long-life RHEL 8.4 streams is in scope.
Red Hat's advisory describes the mechanism only in summary form and has not published a step-by-step exploitation write-up. What is stated is that when flatpak-builder processes a patch source with the `use-git-am` option, the underlying `git am` invocation can trigger Git hook execution, and those hooks run as code on the host rather than being confined to the build environment. That places the trust boundary on the contents of the source material being built, since the manifest and patch set determine what `git am` is asked to apply. The fixed package is flatpak-builder-1.0.9-4.el8_4, shipped alongside matching debuginfo and debugsource RPMs.
The practical exposure here is concentrated on build and packaging infrastructure, which is often more trusted and less monitored than production servers, and which frequently holds signing keys, registry credentials and CI tokens. A build host that executes attacker-supplied hook code during what looks like a routine package build gives an adversary a quiet foothold inside the software supply chain. The affected RHEL 8.4 streams are extended-support channels typically used in change-controlled environments where patch windows are infrequent, which lengthens the period of exposure. On current evidence there is no confirmed exploitation: FIRST EPSS places the probability of exploitation in the next 30 days at 0.3 percent for CVE-2026-86320, and the vendor reports no in-the-wild activity.
Attack Surface
Supply Chain (Third-party vendors), Server OS
Tactics
Execution, Initial Access
Techniques
- T1195.001 – Supply Chain Compromise: Compromise Software Dependencies and Development Tools
- T1059 – Command and Scripting Interpreter
SuperPRO's Threat Countermeasures Procedures
- Install flatpak-builder-1.0.9-4.el8_4.x86_64.rpm (SRPM flatpak-builder-1.0.9-4.el8_4.src.rpm) from RHSA-2026:92220 on all Red Hat Enterprise Linux Server AUS 8.4 and RHEL for x86_64 Extended Life Cycle Long Life 8.4 hosts, along with the matching flatpak-builder-debuginfo and flatpak-builder-debugsource packages where they are deployed.
- Inventory affected systems with `rpm -q flatpak-builder` across the estate and treat any build host reporting a version earlier than 1.0.9-4.el8_4 as in scope; Red Hat Insights patch analysis can be used to list systems matching RHSA-2026:92220.
- Audit Flatpak manifests in your build pipelines for patch sources that set `use-git-am` or `use-git-am-3`, and remove or review those entries until the patched flatpak-builder package is installed.
- Treat Git repositories and patch sets consumed by flatpak-builder as untrusted input: clone with hooks disabled where possible (for example by setting core.hooksPath to an empty directory in the build account) so that .git/hooks content shipped with source material cannot run.
- Run flatpak-builder jobs under a dedicated low-privilege service account in a disposable container or VM rather than on a shared host, so that host code execution via CVE-2026-86320 cannot reach signing keys, registry credentials or CI tokens.
- Enable auditd or EDR process-creation alerting on child processes spawned by flatpak-builder and git during build jobs, particularly shells (/bin/sh, /bin/bash) launched from a `git am` invocation, and alert on outbound network connections initiated by the build user.
- Track Bugzilla BZ-2471023 and the CVE-2026-86320 page for updated CVSS scoring and any revised guidance, and schedule the update inside the next change window for extended-support 8.4 hosts that cannot be patched immediately.
