--- title: "A Skipped Cookie Check Let Flatpak Apps Escape PipeWire’s Sandbox Entirely" url: https://daily.dev/posts/a-skipped-cookie-check-let-flatpak-apps-escape-pipewire-s-sandbox-entirely-i32pfsskc source_url: https://latesthackingnews.com/2026/08/02/pipewire-sandbox-escape-cve-2026-5674 type: article source: "Latest Hacking News" published: 2026-08-02T11:06:58.901Z updated: 2026-08-02T11:07:21.007Z tags: ["security"] reading_time: 5 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # A Skipped Cookie Check Let Flatpak Apps Escape PipeWire’s Sandbox Entirely **[Latest Hacking News](https://daily.dev/sources/lhn)** · 5 min read · 0 upvotes · 0 comments ## Summary CVE-2026-5674 is a CVSS 8.8 sandbox escape in PipeWire's PulseAudio compatibility layer. Three chained flaws enable the exploit: the authentication cookie is read but never verified, module loading is enabled by default for 'authenticated' clients, and module-ladspa-sink calls dlopen() on arbitrary paths without validation. A Flatpak app with only --socket=pulseaudio permission can write a malicious shared library to /tmp, send a junk cookie, load the module pointing at that library, and achieve arbitrary code execution as the logged-in user — no elevated privileges or race conditions required. Discovered by Johann Rehberger using an AI-assisted research pipeline (Claude Code/Opus), the bug was confirmed on PipeWire 1.0.5, reported to Red Hat on April 5, and patched by restricting dlopen() from loading libraries off arbitrary absolute paths. Red Hat shipped RHSA-2026:47083 on July 28. Defenders should patch PipeWire, audit Flatpak apps requesting --socket=pulseaudio with filesystem access, and strip unnecessary permissions. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Escaping Linux Sandboxes via PipeWire \(CVE-2026-5674\) · Embrace The Red](https://daily.dev/posts/escaping-linux-sandboxes-via-pipewire-cve-2026-5674-embrace-the-red-x9e0vsjk1) · Embrace The Red · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/a-skipped-cookie-check-let-flatpak-apps-escape-pipewire-s-sandbox-entirely-i32pfsskc)