CVE-2026-34080

MEDIUM

xdg-dbus-proxy has an eavesdrop filter bypass allowing message interception

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-34080 has a selected CVSS score of 6.8 (medium).

Description

xdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop restrictions. The proxy checks for eavesdrop=true in policy rules but fails to handle eavesdrop ='true' (with a space before the equals sign) and similar cases. Clients can intercept D-Bus messages they should not have access to. This vulnerability is fixed in 0.1.7.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 8, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

xdg-dbus-proxy

Browse flatpak / xdg-dbus-proxy
CVE List< 0.1.7affected

References

3