Red Hat Flatpak Update Addresses Four RHEL 10 Vulnerabilities
Tech GuruQuick Answer
Red Hat published RHSA-2026:80498 for Flatpak on RHEL 10.2. Match entitled systems to the exact advisory relationships, install flatpak 1.16.0-9.el10_2.4 and the matching advisory-listed packages, validate dependent operations, and retain evidence.
Validate scope and apply the branch-specific Red Hat fix
What to do now: Inventory Flatpak on RHEL 10.2, compare installed NEVRAs with the exact advisory product relationships, install the supported package for each entitled branch, validate representative services, and document exceptions.
Last verified: 2026-10-12 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Flatpak on RHEL 10.2 |
|---|---|
| Advisory | RHSA-2026:80498 |
| CVEs | CVE-2026-90616, CVE-2026-96275, CVE-2026-96280, CVE-2026-96808 |
| Authoritative release date | 2026-10-12 03:12:32 UTC |
| Authority revision date | 2026-10-12 03:12:59 UTC |
| Affected versions | The RHEL 10.2 Flatpak package relationship identified by RHSA-2026:80498. |
| Fixed version | flatpak 1.16.0-9.el10_2.4 and the matching advisory-listed packages |
| CVSS base score | 7.5 / 7.8 / 8.8 (CVSS v3.1) |
| CVSS severity | High |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
Red Hat published branch-specific Flatpak replacement content for the advisory-listed CVEs and product relationships.
What To Validate Now
- Inventory. Locate Flatpak on RHEL 10.2; record the installed NEVRA, repository and entitlement, accountable owner, exposure, dependent services, and maintenance group.
- Establish applicability. Use the product-status relationships in RHSA-2026:80498. Do not infer applicability from the component name, CVE overlap, or CVSS rating alone.
- Remediate. Install flatpak 1.16.0-9.el10_2.4 and the matching advisory-listed packages from the supported Red Hat channel for the exact entitled branch.
- Validate. Confirm the installed package, exercise representative Flatpak and dependent-service functions, monitor for regressions, and document any exception or rollback.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Validate application launch, portals, permissions, remotes, sandbox behavior, and managed desktop workflows after updating. Preserve pre-change versions, package-manager output, service restart evidence, validation results, and any rollback decision.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
