Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-93676: xdg-dbus-proxy lets sandbox apps read restricted broadcasts

CVE-2026-93676 · published 1 month ago

Summary

The xdg-dbus-proxy program included in Red Hat Enterprise Linux 9 and 10, Debian and Ubuntu does not correctly block certain system messages. This lets a sandboxed Flatpak application hear messages that should be hidden, potentially revealing private information from other apps. Apply the latest security update or upgrade the xdg-dbus-proxy package from your distribution’s official repository.

What to do

Update debian xdg-dbus-proxy to version 0.1.6-1+deb13u2.
Update debian xdg-dbus-proxy to version 0.1.8-1.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	red hat	red hat enterprise linux 10	All versions
–	red hat	red hat enterprise linux 9	All versions
Debian:13	debian	xdg-dbus-proxy	< 0.1.6-1+deb13u2 Fix: upgrade to 0.1.6-1+deb13u2
Debian:14	debian	xdg-dbus-proxy	< 0.1.8-1 Fix: upgrade to 0.1.8-1
Ubuntu:Pro:20.04:LTS	canonical	xdg-dbus-proxy	All versions

Original advisory text

Xdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checks

xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted, potentially exposing sensitive information to unauthorized applications.

References

https://access.redhat.com/security/cve/CVE-2026-93676 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2537014 Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2026-93676 Vendor Advisory
https://ubuntu.com/security/CVE-2026-93676 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-93676 Third Party Advisory
https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-r7hp-698j-2h6... Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/09/22/24

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

3.2 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-284Improper Access Control

Timeline

Published18 Sep 2026

Updated26 Oct 2026

First seen18 Sep 2026

Sources

CVE-2026-93676 · NVD

CVE-2026-93676 · MITRE

DEBIAN-CVE-2026-93676 · OSV

UBUNTU-CVE-2026-93676 · OSV

Track software like this

Free during beta