Critical Symlink Traversal Vulnerability in Bubblewrap Package
Summary
RLSA-2026:85308: Important: bubblewrap security update. Affects bubblewrap versions < 0:0.10.0-5.el10_2. Fixed in 0:0.10.0-5.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bubblewrap is a core execution engine designed for unprivileged containers, allowing users to run applications in isolated environments. It operates as a setuid binary on kernels that do not support user namespaces, providing a layer of security by restricting the access of applications to the host system. However, this functionality also makes it susceptible to vulnerabilities that can compromise the security of the containerized applications.
Vulnerability Detail
The vulnerability identified as CVE-2026-87766 in Bubblewrap allows for a symlink traversal attack via the '/oldroot' path. This flaw can enable an attacker to write files outside the intended sandbox during the setup phase, potentially leading to unauthorized access to sensitive data or system files. The impact of this vulnerability is significant, with a CVSS score of 8.8, indicating a high severity level. Attackers exploiting this vulnerability could gain elevated privileges or manipulate the container environment, posing a serious risk to system integrity.
How To Fix
Minimum fixed version
0:0.10.0-5.el10_2
This is the first release that contains the fix.
sudo dnf update bubblewrapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict the use of Bubblewrap in environments where the vulnerability may be exploited until the package is updated. Additionally, reviewing and limiting the permissions of applications that utilize Bubblewrap can help mitigate potential risks.
Conclusion
The Bubblewrap vulnerability (CVE-2026-87766) poses a significant risk due to its potential for symlink traversal attacks, allowing unauthorized file access outside the sandbox. It is crucial for users to update to the patched version of Bubblewrap to mitigate this risk. Employing temporary workarounds can help reduce exposure until the update is applied.
See every vulnerability recorded for bubblewrap →
FAQ
The vulnerability allows for symlink traversal, enabling attackers to write files outside the intended sandbox.
You can use Vulert's playground at Vulert Scanner to check if your application is impacted by this vulnerability without any signup.
The CVSS score for this vulnerability is 8.8, indicating a high severity level.
As a workaround, consider restricting the use of Bubblewrap and reviewing application permissions to limit exposure.
The vulnerability was acknowledged by the Rocky Enterprise Software Foundation and Red Hat.
Related vulnerabilities
Recent vulnerabilities recorded for bubblewrap.
