Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-86320
Red Hat Red Hat Enterprise Linux 10 — Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)
AV AC PR UI S C I A CVSS EPSS %ile KEV
L L N R U H H H 7.8 .0022 12.1 —
AFFECTED
Product Versions Fixed
Red Hat Enterprise Linux 10 unspecified 0:1.4.4-1.el10_2.1
Red Hat Enterprise Linux 8 unspecified 0:1.2.3-2.el8_10
Red Hat Enterprise Linux 9 unspecified 0:1.2.3-1.el9_8.1
TIMELINE
Sep 7 Reserved by redhat
Sep 17 Published (CNA: redhat)
Oct 11 PATCH SHIPPED — CVE-2026-86320 (Red Hat Enterprise Linux 10). Fixed in Red Hat Enterprise Linux 10 0:1.4.4-1.el10_2.1.
Description
A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| September 7, 2026 | Reserved | Reserved by redhat |
| September 17, 2026 | Published | Published (CNA: redhat) |
| October 11, 2026 | PATCH SHIPPED | PATCH SHIPPED — CVE-2026-86320 (Red Hat Enterprise Linux 10). Fixed in Red Hat Enterprise Linux 10 0:1.4.4-1.el10_2.1. |
Affected
Affected products and packages — 3 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — | 0:1.4.4-1.el10_2.1 |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | 0:1.2.3-2.el8_10 |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | 0:1.2.3-1.el9_8.1 |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-86320 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
