Skip to main content

bubblewrap CVE-2026-87766

| EUVDEUVD-2026-74778 HIGH
Improper Link Resolution Before File Access (CWE-59)
2026-09-09 redhat
Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Hardened Images Red Hat
8.8
CVSS 3.1 · Vendor: redhat
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Plant symlink in sandbox directory tree
  2. Delivery
    Invoke bubblewrap sandbox setup (e.g., via Flatpak)
  3. Exploit
    Setup follows /oldroot symlink outside sandbox root
  4. Execution
    Attacker-controlled file written to host path
  5. Persist
    Trigger planted payload on next host user session
  6. Impact
    Achieve code execution or data access on host

Vulnerability Assessment

Weakness
CWE
CWE-59
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Symlink resolution safety
Exploitation Conditions

The attacker must be a local user with permission to invoke bubblewrap or Flatpak (CVSS PR:L), which on most desktop Linux systems means any ordinary user account. The flaw is triggered entirely during sandbox setup before the sandboxed process starts, so the attacker controls the sandbox configuration (directory tree, bind mounts, symlinks) passed to bwrap - this is the core exploitation condition. No interaction from a second user is required (UI:N). Exploitation is strictly bounded by the launching user's host filesystem permissions: only paths writable by that user can be targeted, ruling out overwriting root-owned system files without a separate privilege escalation step. No special or non-default configuration of bubblewrap is needed; a standard Flatpak installation or any direct bwrap invocation is sufficient. Kernels fully patched with openat2 RESOLVE_IN_ROOT support (5.6+) in combination with bubblewrap 0.12.0 close the vulnerability at the system call level.
Impact

The CVSS 8.8 vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H accurately captures the sandbox escape class: the scope change (S:C) reflects the pivot from the sandboxed environment to the host filesystem. The primary primitive is an arbitrary file write as the launching user, making I:H clearly justified; C:H and A:H are plausible if the attacker chains the write to achieve code execution (e.g., planting a malicious .bashrc, cron entry, or SSH authorized_keys), which could subsequently read or destroy host data. No EPSS data was provided, but the AV:L requirement and absence of KEV listing and public exploit code suggests that mass opportunistic exploitation is not occurring - the attack requires local user access and deliberate sandbox configuration manipulation. Even a mid-sized municipal IT team in kielce running Flatpak-deployed applications should treat this as urgent given that the entire trust guarantee of the bubblewrap sandbox model is undermined: sandboxed applications are assumed to be untrusted, so any sandbox escape is a high-severity architectural failure regardless of ease of chaining. SSVC signals: exploitation not yet confirmed as automated, technical impact is total within accessible scope, making this a prioritized patch target for Flatpak-dependent environments.
Exploit ScenarioDerived

A local user on a system running bubblewrap below 0.12.0 constructs a sandbox configuration containing a symlink under the sandbox directory tree that, when resolved via /oldroot during setup, points to an arbitrary writable host path such as the user's ~/.bashrc or ~/.ssh/authorized_keys. When the user invokes Flatpak or bwrap directly to launch any sandboxed application, bubblewrap's setup phase follows the symlink and writes an attacker-controlled file to that host path - before the sandboxed process starts - enabling the attacker to plant a persistent backdoor or hijack the user's session without any code executing inside the sandbox. No public exploit code has been identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 09, 2026

Sandbox escape in bubblewrap prior to 0.12.0 allows a local, low-privileged user to write files or directories to arbitrary host paths outside the sandbox boundary by exploiting symlink resolution during the pre-execution setup phase (CWE-59). The escape occurs via /oldroot - bubblewrap's bind-mounted original root - before the sandboxed process ever starts, meaning no code execution inside the sandbox is needed to trigger it. Distributions including Red Hat Enterprise Linux 8, 9, and 10 and Debian are confirmed affected; the upstream fix is available as bubblewrap 0.12.0 and no public exploit code has been identified at time of analysis.

RemediationAI

Vendor-released patch: bubblewrap 0.12.0. Upgrade to bubblewrap 0.12.0 or later, available at https://github.com/containers/bubblewrap/releases/tag/v0.12.0. Red Hat customers on RHEL 8, 9, and 10 should apply updates via the RHSA advisory tracked at https://access.redhat.com/security/cve/CVE-2026-87766. Debian users should monitor https://bugs.debian.org/1145655 for the patched package availability. Note that bubblewrap 0.12.0 removes setuid support entirely - before upgrading, confirm that your kernel and distribution support unprivileged user namespaces (kernel 3.8+ with appropriate sysctl, standard on RHEL 8+ and modern Debian). As a compensating control prior to patching, restrict which local user accounts have permission to invoke Flatpak or bwrap directly, reducing the population of users who can trigger sandbox setup; this does not eliminate the vulnerability but reduces the exposure surface. Avoid relying on bubblewrap's sandbox isolation guarantees in untrusted multi-user environments until the patch is applied.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

bubblewrap (bwrap) is the low-level unprivileged sandboxing tool that underpins Flatpak on Linux, using Linux user namespaces to build isolated root filesystems. The root cause is CWE-59 (Improper Link Resolution Before File Access): during sandbox setup, when bubblewrap creates files or directories under the new root, it previously did not restrict path resolution to within the intended root boundary. A symlink planted under /oldroot (the bind mount of the original host root that bubblewrap uses internally during setup) could redirect file creation to arbitrary host paths accessible to the launching user. The fix in 0.12.0 resolves this by calling openat2() with RESOLVE_IN_ROOT semantics - or a fallback implementation for kernels older than 5.6.0 - which constrains all path traversal to the target directory tree. The release also removes setuid bubblewrap support, leaving unprivileged user namespaces as the sole execution model. CPE strings in the input identify Red Hat Enterprise Linux 8, 9, 10, and Red Hat Hardened Images as affected packaging contexts, with the upstream project residing at containers/bubblewrap on GitHub.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI 8.7 HIGH

Primary primitive is arbitrary file write outside sandbox scope (I:H, A:H via overwrite); confidentiality impact is secondary and limited to write-chaining, not direct data exfiltration.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:H
SUSE 8.6 HIGH
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Red Hat 8.8 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0.

Technical POC Analysis

The flaw is improper link resolution before file access (CWE-59), producing a path traversal effect outside the sandbox.

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Sign in to read

Executive ViewAI

Why It Matters

Bubblewrap, a container sandboxing utility deployed across RHEL and Debian production environments, contains a privilege escalation vulnerability (CVSS 8.8) allowing local users to bypass sandbox isolation and write arbitrary files to host systems. For organizations relying on container security boundaries, this directly compromises the intended separation between applications and host infrastructure. Immediate patching is required to restore isolation guarantees and mitigate risk to containerized workloads.

Business Impact: High
Compensating Controls

Apply vendor patch: bubblewrap 0.12.0 or later.

Threat Intelligence Overview

EPSS Score
0.1%
Top 96% exploitable
Prevalence
Medium
bubblewrap is Flatpak's sandbox layer, common on Linux desktops
Social Media
1
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_hardened_images:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-59 – Improper Link Resolution Before File Access

View all
CVE-2020-0787 HIGH POC
7.8
CVE-2015-1130 HIGH POC
7.8
CVE-2015-5287 HIGH POC
7.8
CVE-2026-41091 HIGH POC
7.8
CVE-2019-1069 HIGH POC
7.8
CVE-2026-81963 HIGH POC
7.8
CVE-2016-6664 HIGH POC
7.0
CVE-2025-60710 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server 16.1 Affected

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8779-1 ADVISORY https://vuldb.com/vuln/401641 REF http://www.openwall.com/lists/oss-security/2026/09/09/3 REF http://www.openwall.com/lists/oss-security/2026/09/22/23 REF https://access.redhat.com/errata/RHSA-2026:85306 REF https://access.redhat.com/errata/RHSA-2026:85308 REF https://access.redhat.com/errata/RHSA-2026:85309 REF https://access.redhat.com/errata/RHSA-2026:85312 REF https://access.redhat.com/errata/RHSA-2026:85313 REF https://access.redhat.com/errata/RHSA-2026:85317 REF https://access.redhat.com/errata/RHSA-2026:85319 REF https://access.redhat.com/errata/RHSA-2026:85322 REF https://access.redhat.com/errata/RHSA-2026:85324 REF https://access.redhat.com/errata/RHSA-2026:85325 REF https://access.redhat.com/security/cve/CVE-2026-87766 REF https://bugs.debian.org/1145655 REF https://bugzilla.redhat.com/show_bug.cgi?id=2530542 REF https://github.com/containers/bubblewrap/releases/tag/v0.12.0 REF https://github.com/containers/bubblewrap/security/advisories/GHSA-pxhw-h44j-8pfx REF https://www.openwall.com/lists/oss-security/2026/08/27/7

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy