CVE record · CVE-2026-94422

xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape

CVSS 8.7 HighEPSS 0.0050 · 42nd percentile

Published by the CVE Program (CNA: redhat) at 2 Oct 2026, 13:54 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Not given	Not given Package name: xdg-dbus-proxy https://github.com/flatpak/xdg-dbus-proxy	affected before 0.1.9 semver Other versions: unaffected
Fedora	Fedora Package name: xdg-dbus-proxy https://bodhi.fedoraproject.org/updates/?packages=xdg-dbus-proxy	affected before 0.1.9 semver Other versions: unaffected
Red Hat	Red Hat Enterprise Linux 9 Package name: xdg-dbus-proxy https://access.redhat.com/downloads/content/package-browser/	No versions given Other versions: affected
Red Hat	Red Hat Enterprise Linux 10 Package name: xdg-dbus-proxy https://access.redhat.com/downloads/content/package-browser/	No versions given Other versions: affected

Identifiers: CVE-2026-94422
CNA: redhat
Weakness (CWE): CWE-290
Tags: Fedora
Red Hat Enterprise Linux 9
Red Hat Enterprise Linux 10
Authentication bypass
Published: 2 Oct 2026
Updated: 24 Oct 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
8.8	High	3.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	CNA (redhat)
8.7	High	4.0	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	CNA (redhat)Used for this record

CISA KEV Not listed.
EPSS 0.0050, the 42nd percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 2 Oct 2026. New records show when each source confirmed them.

Sources

References from the CNA

access.redhat.com/security/cve/CVE-2026-94422 vendor-advisory
github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-2cgv-pwcq-wvpq third-party-advisory
github.com/flatpak/xdg-dbus-proxy/commit/e5702fca4dba9600721921fbca2dbc39dc5ca400 patch
github.com/flatpak/xdg-dbus-proxy/commit/fc027f759316fb2a6c45648200b6f100202eb84e patch
github.com/flatpak/xdg-dbus-proxy/commit/e4465a0dfe96da3b39929a30a1ac3a22b16223e3 patch
bugzilla.redhat.com/show_bug.cgi?id=2542235 issue-tracking

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.