Critical Security Flaw in Bubblewrap: Symlink Traversal Vulnerability
Summary
ALSA-2026:85308: Important: bubblewrap security update. Affects bubblewrap versions < 0.10.0-5.el10_2. Fixed in 0.10.0-5.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bubblewrap is a core execution engine designed for unprivileged containers, functioning as a setuid binary on kernels that lack user namespaces. It allows users to create isolated environments for running applications securely. However, its design can expose it to vulnerabilities, particularly when it comes to file system interactions.
Vulnerability Detail
The vulnerability identified as CVE-2026-87766 is a symlink traversal issue that occurs during the setup phase of Bubblewrap. This flaw allows an attacker to exploit the '/oldroot' symlink, enabling them to write files outside of the intended sandbox environment. The ramifications of this vulnerability can lead to unauthorized access to sensitive files and potential system compromise, making it critical to address promptly.
How To Fix
Minimum fixed version
0.10.0-5.el10_2
This is the first release that contains the fix.
sudo dnf update bubblewrapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict the use of Bubblewrap or avoid running applications that depend on it until the update is applied. Additionally, consider implementing stricter file permissions to mitigate the risk of unauthorized file access.
Conclusion
The Bubblewrap vulnerability (CVE-2026-87766) poses a significant risk due to its symlink traversal flaw, allowing unauthorized file access. Users are urged to update to the latest patched version to secure their systems and applications.
See every vulnerability recorded for bubblewrap →
FAQ
Bubblewrap is a tool that allows users to create unprivileged containers for running applications in isolated environments.
It allows attackers to exploit a flaw in Bubblewrap to write files outside the intended sandbox, potentially leading to unauthorized access.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check your application without needing to sign up.
The primary risk is unauthorized access to sensitive files and potential system compromise, which can lead to further exploitation.
It is recommended to regularly check for updates and apply them promptly to mitigate the risk of vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for bubblewrap.
