Low severity3.3NVD Advisory· Published Sep 27, 2026· Updated Sep 29, 2026

CVE-2026-96283

Description

By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.

Affected products

Flatpak/Flatpakllm-fuzzy

Patches

Vulnerability mechanics

References

access.redhat.com/security/cve/CVE-2026-96283nvd
bugzilla.redhat.com/show_bug.cginvd
github.com/flatpak/flatpak/security/advisories/GHSA-89xm-3m96-w3jgnvd

News mentions

Flatpak: Twelve Vulnerabilities Disclosed in Deployment and OCI Handling
Vypr Intelligence · Sep 29, 2026

cvss	0.214
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000