CVE-2026-96283

By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.

  • Published Sep 27, 2026
  • CVSS 3.3 low
  • 0.1% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-96283 at the National Vulnerability Database