CVE-2026-34080 xdg-dbus-proxy has an eavesdrop filter bypass allowing message interception
Attackers can bypass eavesdrop restrictions in xdg-dbus-proxy to intercept unauthorized D-Bus messages due to a policy parser flaw.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34080?
CVE-2026-34080 is a medium-severity vulnerability in flatpak xdg-dbus-proxy, published on 7 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
xdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop restrictions. The proxy checks for eavesdrop=true in policy rules but fails to handle eavesdrop ='true' (with a space before the equals sign) and similar cases. Clients can intercept D-Bus messages they should not have access to. This vulnerability is fixed in 0.1.7.
Weakness: CWE-1289
Which versions are affected by CVE-2026-34080?
It affects 1 product.
Linux distribution packages (5)
xdg-dbus-proxy SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 0.1.5-150600.3.5.1 |
xdg-dbus-proxy SUSE:Linux Enterprise Server 16.0 | All versions | 0.1.6-160000.3.1 |
xdg-dbus-proxy SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 0.1.6-160000.3.1 |
xdg-dbus-proxy openSUSE:Leap 16.0 | All versions | 0.1.6-160000.3.1 |
xdg-dbus-proxy openSUSE:Tumbleweed | All versions | 0.1.7-1.1 |
Products include Flatpak Xdg-Dbus-Proxy.
How do I fix CVE-2026-34080?
Upgrade to a fixed version.
Is CVE-2026-34080 being exploited?
There is no known exploitation of CVE-2026-34080 in the wild and no public exploit code.
Sources
Also known as AZL-81957, CLSA-2026-1789126805, CLSA-2026-1789132992, DEBIAN-CVE-2026-34080, GHSA-vjp5-hjfm-7677, MGASA-2026-0178 and 12 more.