Critical Security Flaw in Bubblewrap: Symlink Traversal Vulnerability
Summary
ALSA-2026:85306: Important: bubblewrap security update. Affects bubblewrap versions < 0.4.0-3.el8_10. Fixed in 0.4.0-3.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Bubblewrap is a core execution engine designed for unprivileged containers, functioning as a setuid binary on kernels that do not support user namespaces. It allows users to create isolated environments for running applications securely. However, its design can lead to vulnerabilities, particularly when it comes to file system access and sandboxing.
Vulnerability Detail
The vulnerability identified as CVE-2026-87766 involves a symlink traversal issue that permits unauthorized file writing outside the intended sandbox during the setup phase. This flaw arises from improper handling of symlinks in the /oldroot directory, which can be exploited by an attacker to manipulate files and potentially compromise the host system. The ramifications of this vulnerability are significant, as it undermines the security model of containerized applications, allowing for potential data breaches and unauthorized access.
How To Fix
Minimum fixed version
0.4.0-3.el8_10
This is the first release that contains the fix.
sudo dnf update bubblewrapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using Bubblewrap for executing unprivileged containers until the package is updated. Additionally, ensuring that the application does not rely on symlinked directories during its execution can help mitigate the risk.
Conclusion
The Bubblewrap symlink traversal vulnerability (CVE-2026-87766) poses a significant risk to systems using this package for unprivileged containers. It is crucial to update to the patched version to mitigate potential security threats. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for bubblewrap →
FAQ
Bubblewrap is a tool that provides a secure way to run applications in isolated environments, commonly used for unprivileged containers.
It allows attackers to write files outside the intended sandbox, potentially compromising the host system's security.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
As a temporary measure, avoid using Bubblewrap for unprivileged containers and ensure that your applications do not use symlinked directories.
For detailed information, refer to the CVE page associated with CVE-2026-87766.
Related vulnerabilities
Recent vulnerabilities recorded for bubblewrap.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
