Public vulnerability disclosure

CVE-2026-87766

Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup

publishedCWE-59

A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0.

Investigate in Cyber JSON Markdown

Technical severity8.8 highCVSS 3.1 · CNA: redhat

Published2026-09-09Source updated 2026-11-02

Collected2026-11-022 attributed sources

Fixes and workarounds

Workaround

Do not create files on untrusted content with unpatched bwrap. Do not install untrusted Flatpaks. No upstream fix for older setuid builds.

Source: CNA: redhat

Affected products and versions

Affected products, source version ranges and reporting authorities
Product	Versions	Authority
Red Hat Enterprise Linux 10 Red Hat `bubblewrap` https://access.redhat.com/downloads/content/package-browser/	≥ 0:0.10.0-5.el10_2; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 10.0 Extended Update Support Red Hat `bubblewrap` https://access.redhat.com/downloads/content/package-browser/	≥ 0:0.10.0-3.el10_0.4; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8 Red Hat `bubblewrap` https://access.redhat.com/downloads/content/package-browser/	≥ 0:0.4.0-3.el8_10; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat `bubblewrap` https://access.redhat.com/downloads/content/package-browser/	≥ 0:0.4.0-3.el8_4; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Red Hat `bubblewrap` https://access.redhat.com/downloads/content/package-browser/	≥ 0:0.4.0-3.el8_4; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat `bubblewrap` https://access.redhat.com/downloads/content/package-browser/	≥ 0:0.4.0-3.el8_6; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Red Hat `bubblewrap` https://access.redhat.com/downloads/content/package-browser/	≥ 0:0.4.0-3.el8_6; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.8 Telecommunications Update Service Red Hat `bubblewrap` https://access.redhat.com/downloads/content/package-browser/	≥ 0:0.4.0-3.el8_8; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat `bubblewrap` https://access.redhat.com/downloads/content/package-browser/	≥ 0:0.4.0-3.el8_8; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 9 Red Hat `bubblewrap` https://access.redhat.com/downloads/content/package-browser/	≥ 0:0.6.3-1.el9_8.1; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Red Hat `bubblewrap` https://access.redhat.com/downloads/content/package-browser/	≥ 0:0.4.1-7.el9_2.1; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Red Hat `bubblewrap` https://access.redhat.com/downloads/content/package-browser/	≥ 0:0.4.1-7.el9_4.1; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 9.6 Extended Update Support Red Hat `bubblewrap` https://access.redhat.com/downloads/content/package-browser/	≥ 0:0.4.1-8.el9_6.1; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Hardened Images Red Hat `bubblewrap` https://access.redhat.com/downloads/content/package-browser/	Range not reported Other versions: unaffected	CNA: redhat

Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.

CVSS assessments

CVSS scores, vectors and reporting authorities
Version / score	Vector	Authority
3.1 / 8.8 high	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`	CNA: redhat

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

References

https://access.redhat.com/errata/RHSA-2026:85306CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:85308CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:85309CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:85312CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:85313CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:85317CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:85319CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:85322CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:85324CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:85325CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-87766CNA: redhat · vdb-entry, x_refsource_REDHAT
https://bugs.debian.org/1145655CNA: redhat
https://bugzilla.redhat.com/show_bug.cgi?id=2530542CNA: redhat · issue-tracking, x_refsource_REDHAT
https://github.com/containers/bubblewrap/releases/tag/v0.12.0CNA: redhat
https://github.com/containers/bubblewrap/security/advisories/GHSA-pxhw-h44j-8pfxCNA: redhat
https://www.openwall.com/lists/oss-security/2026/08/27/7CNA: redhat
http://www.openwall.com/lists/oss-security/2026/09/09/3ADP: CVE
http://www.openwall.com/lists/oss-security/2026/09/22/23ADP: CVE