What’s Vulnerable › Vulnerabilities

CVE-2026-87766: Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-09 · updated 2026-10-20
• Weakness: CWE-59

Description

A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0.

Affected products

• Red Hat Enterprise Linux 10: all versions — fixed in 0:0.10.0-5.el10_2
• Red Hat Enterprise Linux 10.0 Extended Update Support: all versions — fixed in 0:0.10.0-3.el10_0.4
• Red Hat Enterprise Linux 8: all versions — fixed in 0:0.4.0-3.el8_10
• Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support: all versions — fixed in 0:0.4.0-3.el8_4
• Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On: all versions — fixed in 0:0.4.0-3.el8_4
• Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: all versions — fixed in 0:0.4.0-3.el8_6
• Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On: all versions — fixed in 0:0.4.0-3.el8_6
• Red Hat Enterprise Linux 8.8 Telecommunications Update Service: all versions — fixed in 0:0.4.0-3.el8_8
• Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions: all versions — fixed in 0:0.4.0-3.el8_8
• Red Hat Enterprise Linux 9: all versions — fixed in 0:0.6.3-1.el9_8.1
• Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: all versions — fixed in 0:0.4.1-7.el9_2.1
• Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions: all versions — fixed in 0:0.4.1-7.el9_4.1
• Red Hat Enterprise Linux 9.6 Extended Update Support: all versions — fixed in 0:0.4.1-8.el9_6.1

How to fix

Upgrade to a fixed version: Red Hat Enterprise Linux 10 0:0.10.0-5.el10_2; Red Hat Enterprise Linux 10.0 Extended Update Support 0:0.10.0-3.el10_0.4; Red Hat Enterprise Linux 8 0:0.4.0-3.el8_10; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:0.4.0-3.el8_4; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:0.4.0-3.el8_4; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:0.4.0-3.el8_6; Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 0:0.4.0-3.el8_6; Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:0.4.0-3.el8_8; Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:0.4.0-3.el8_8; Red Hat Enterprise Linux 9 0:0.6.3-1.el9_8.1; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:0.4.1-7.el9_2.1; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:0.4.1-7.el9_4.1. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2026:85306
• https://access.redhat.com/errata/RHSA-2026:85308
• https://access.redhat.com/errata/RHSA-2026:85309
• https://access.redhat.com/errata/RHSA-2026:85312
• https://access.redhat.com/errata/RHSA-2026:85313
• https://access.redhat.com/errata/RHSA-2026:85317
• https://access.redhat.com/errata/RHSA-2026:85319
• https://access.redhat.com/errata/RHSA-2026:85322
• https://access.redhat.com/errata/RHSA-2026:85324
• https://access.redhat.com/errata/RHSA-2026:85325
• https://access.redhat.com/security/cve/CVE-2026-87766
• https://bugs.debian.org/1145655

Get alerted when CVE-2026-87766 or the next vulnerability affects your stack