Policy Parser Flaw in xdg-dbus-proxy Affects Flatpak

CVE-2026-34080

What is CVE-2026-34080?

A policy parser vulnerability exists in the xdg-dbus-proxy prior to version 0.1.7. This flaw allows an attacker to bypass eavesdrop restrictions by exploiting an improper handling of whitespace in policy rules. Specifically, checks for eavesdrop=true are ineffective against variants like eavesdrop ='true', enabling unauthorized clients to intercept D-Bus messages, thereby compromising the confidentiality and integrity of the communication. The issue was addressed in version 0.1.7, emphasizing the importance of maintaining updated software to secure against such vulnerabilities.

References