xdg-dbus-proxy: Message filtering bypass leads to sandbox escape
Summary
The D-Bus filtering proxy xdg-dbus-proxy before version 0.1.9 does not properly filter messages on the D-Bus session bus. By setting a reply serial number on non-reply messages, a sandboxed app can bypass the filter and reach D-Bus interfaces that should be blocked. A malicious or compromised Flatpak app (or an app run through another framework such as Firejail that uses this proxy) could then execute code outside its sandbox on the host, with the user needing to run the app.
Affected
- xdg-dbus-proxy versions before 0.1.9 (upstream statement)
- Fedora: xdg-dbus-proxy 0 to before 0.1.9
- Red Hat Enterprise Linux 9 and 10 (listed as affected in the CVE record)
- Other distributions and frameworks that ship or depend on xdg-dbus-proxy: unknown, check the vendor advisory
Fixed in
- xdg-dbus-proxy 0.1.9 (upstream fix)
- Fedora 44: update to 0.1.9 released
- Red Hat Enterprise Linux 9.8 Extended Update Support: update available via RHSA-2026:90522
- Other distributions: unknown, check the vendor advisory for the exact package build
Workaround
- Avoid running untrusted Flatpak apps and untrusted apps via other frameworks that use xdg-dbus-proxy
- No other mitigation is known; upgrade to 0.1.9 or the vendor's fixed package
Exploitation
- CISA SSVC assessment: exploitation none, not automatable
- No public proof-of-concept exploit found; upstream tests were added to the project's regression suite
- EPSS 0.00693 (low) per one tracker
- One aggregator claims attack traffic was observed; this is unconfirmed
- No confirmed exploitation in the wild
Our recommendation
- Identify Linux systems that run Flatpak apps or Firejail-based sandboxes
- Update xdg-dbus-proxy to 0.1.9 or the vendor's fixed package, and check your distribution's advisory
- Until patched, do not run untrusted Flatpak apps
- Note that the CVSS score is 8.7 (CVSS 4.0, NVD); Red Hat scores 8.8 under CVSS 3.1
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE record CVE-2026-94422 access.redhat.com
- GitHub Security Advisory GHSA-2cgv-pwcq-wvpq github.com
- xdg-dbus-proxy release 0.1.9 github.com
- oss-security discussion (upstream statement) seclists.org
- Red Hat Bugzilla 2542235 bugzilla.redhat.com
- Red Hat Errata RHSA-2026:90522 access.redhat.com
- Fedora 44 advisory for xdg-dbus-proxy linuxsecurity.com
- Ubuntu security status CVE-2026-94422 ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:46.
Original description (NVD)
An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.
NVD references (8)
- https://access.redhat.com/security/cve/CVE-2026-94422
- https://bugzilla.redhat.com/show_bug.cgi?id=2542235
- https://github.com/flatpak/xdg-dbus-proxy/commit/e4465a0dfe96da3b39929a30a1ac3a22b16223e3
- https://github.com/flatpak/xdg-dbus-proxy/commit/e5702fca4dba9600721921fbca2dbc39dc5ca400
- https://github.com/flatpak/xdg-dbus-proxy/commit/fc027f759316fb2a6c45648200b6f100202eb84e
- https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-2cgv-pwcq-wvpq
- http://www.openwall.com/lists/oss-security/2026/09/23/5
- https://lists.debian.org/debian-lts-announce/2026/10/msg00050.html
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.