xdg-desktop-portal: Predictable token generation enables clipboard and drag-and-drop theft
Summary
xdg-desktop-portal, the desktop integration service used by Flatpak and Snap applications on Linux, generates some access tokens with GLib's Mersenne Twister-based random functions. A malicious sandboxed application can use FileTransfer.RetrieveFiles to redirect drag-and-drop and copy-paste data meant for other applications to itself. The advisory states that observed tokens can allow prediction of later tokens. Exploitation requires that a malicious sandboxed app is already running in the user session.
Affected
- flatpak xdg-desktop-portal before 1.22.1 (CNA range: < 1.22.1; VulDB states up to 1.22.0)
Fixed in
- Upstream: 1.22.1 (released 17 June 2026)
- Fedora 44 stable: 1.22.1-1.fc44
- Debian unstable and testing: 1.22.1+ds-1
- Alpine edge: 1.22.1-r0
- Gentoo: lagging, latest tree version 1.20.4-r1 at time of research
- Other distributions: Unknown.
Workaround
- None. The vendor states there is no known mitigation other than updating.
Exploitation
- No evidence found of exploitation in the wild, public proof of concept or CISA KEV listing (not fully verified).
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- EPSS 0.00345 (low).
Our recommendation
- Update xdg-desktop-portal to 1.22.1 or your distribution's fixed build.
- Install only trusted Flatpak or Snap applications and remove unused ones.
- Prioritise Linux workstations that handle sensitive data.
- Check your distribution's security tracker for the fixed version, as some distributions still list the CVE as pending.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- flatpak xdg-desktop-portal 1.22.1 release notes github.com
- GHSA-c5cf-79w8-pvfh advisory github.com
- Ubuntu security notice CVE-2026-55889 ubuntu.com
- VulDB entry 425784 vuldb.com
- Fedora package xdg-desktop-portal packages.fedoraproject.org
- Debian tracker xdg-desktop-portal tracker.debian.org
- Alpine package xdg-desktop-portal pkgs.alpinelinux.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:16.
Original description (NVD)
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste data targeted at other applications to itself. Some portals generate tokens which provide access to resources. The sharing of the token transfers access to the resource and is supposed to happen out of band. The tokens were generated with g_random_int or g_uuid_string_random, both of which use GLib's GRand based on the Mersenne Twister PRNG which created a stream of reproducible random numbers. By generating enough tokens, the state of the GRand can be recover and with it, the next tokens can be predictedinsufin. This issue has been patched in version 1.22.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.