VulnSocial

CVE-2026-34080Disclosure(flatpak / xdg-dbus-proxy)

LOWCVSS 5.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

xdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop restrictions. The proxy checks for eavesdrop=true in policy rules but fails to handle eavesdrop ='true' (with a space before the equals sign) and similar cases. Clients can intercept D-Bus messages they should not have access to. This vulnerability is fixed in 0.1.7.

flatpak CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-1289

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • xdg-dbus-proxy

Threat summary

  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • Peaked 1d ago at 2 mentions (2026-04-08); latest day: 1
  • 3 total mentions across 2 days

Affected systems

Vendors
flatpak
Products
xdg-dbus-proxy

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-04-08: 2Mentions · 2026-04-11: 1Technical Details · 2026-04-08: 2Technical Details · 2026-04-11: 104-0804-11
Signal classification1 categories
Disclosure
3100.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-04-082
Disclosure2
2026-04-111
Disclosure1
Full discourse3 posts
  • Open Source Security mailing list@oss_security
    Disclosure

    2 more related to Flatpak: xdg-desktop-portal: Trashing of arbitrary host files https://www.openwall.com/lists/oss-security/2026/04/10/14 CVE-2026-34080: xdg-dbus-proxy: Eavesdrop filter bypass allows message interception https://www.openwall.com/lists/oss-security/2026/04/10/15 a typical attacker would be a malicious or compromised Flatpak app

    Post summary

    OpenWall disclosed two new Flatpak‑related CVEs, detailing their impact (file trashing and message interception), but no PoC, exploit, or remediation is provided.

    00010196
    4.4K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-34080 Policy Parser Vulnerability in xdg-dbus-proxy Before 0.1.7 Allows Eavesdrop Bypass https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-34080

    Post summary

    The snippet announces a policy parser flaw in xdg-dbus-proxy (pre‑0.1.7) that permits eavesdrop bypass, with no PoC, exploit code, patch, or active exploitation details provided.

    0000061
    4.0K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-34080 xdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop restrictions. The proxy checks for… https://www.cve.org/CVERecord?id=CVE-2026-34080

    Post summary

    The post announces CVE-2026-34080, detailing a policy‑parser vulnerability in xdg‑dbus‑proxy that enables bypassing eavesdrop restrictions, but it provides no PoC, exploit, patch, or evidence of active exploitation.

    00000156
    57.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appflatpakxdg-dbus-proxy---

Explore more

Back to dashboardflatpak CVEsxdg-dbus-proxy vulnerabilities