Critical Symlink Traversal Vulnerability in Bubblewrap Package
Summary
RLSA-2026:85309: Important: bubblewrap security update. Affects bubblewrap versions < 0:0.6.3-1.el9_8.1. Fixed in 0:0.6.3-1.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bubblewrap is a core execution engine designed for unprivileged containers, functioning as a setuid binary on kernels that lack user namespaces. It allows users to create isolated environments for running applications securely. However, due to its design, it is susceptible to vulnerabilities that can compromise the security of the containerized applications.
Vulnerability Detail
The vulnerability identified as CVE-2026-87766 allows for symlink traversal via the /oldroot directory, which can lead to unauthorized file writing outside the intended sandbox environment during the setup process. This flaw can be exploited by attackers to manipulate files and potentially gain access to sensitive data or system resources, thereby undermining the integrity and confidentiality of the containerized applications.
How To Fix
Minimum fixed version
0:0.6.3-1.el9_8.1
This is the first release that contains the fix.
sudo dnf update bubblewrapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the /oldroot directory or implement additional file system permissions to mitigate the risk of exploitation until the package is updated.
Conclusion
The Bubblewrap package has a critical vulnerability that allows for symlink traversal, potentially leading to unauthorized file access. It is crucial to update to the patched version to secure your applications. Utilize tools like Vulert to monitor for vulnerabilities and ensure your software remains secure.
See every vulnerability recorded for bubblewrap →
FAQ
The CVSS score for this vulnerability is 8.8, indicating a high level of severity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized file access and manipulation, compromising the security of applications running in unprivileged containers.
Yes, a patched version of Bubblewrap is available. Updating to version 0:0.6.3-1.el9_8.1 will resolve the issue.
If immediate updates are not possible, consider implementing file system permission restrictions as a temporary workaround to limit exposure to the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for bubblewrap.
