Low severity3.3NVD Advisory· Published Sep 27, 2026· Updated Sep 27, 2026

CVE-2026-96283

Description

By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.

Affected products

Flatpak/Flatpakllm-fuzzy

Patches

Vulnerability mechanics

References

access.redhat.com/security/cve/CVE-2026-96283nvd
bugzilla.redhat.com/show_bug.cginvd
github.com/flatpak/flatpak/security/advisories/GHSA-89xm-3m96-w3jgnvd

News mentions

No linked articles in our index yet.

cvss	0.214
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000