{"id":"CVE-2026-87766","aliases":["ALSA-2026:85306","ALSA-2026:85308","ALSA-2026:85309","AZL-100908","CLSA-2026-1791475845","DEBIAN-CVE-2026-87766","EUVD-2026-74778","GHSA-pxhw-h44j-8pfx","MGASA-2026-0371","RHSA-2026:85306","RHSA-2026:85308","RHSA-2026:85309","RHSA-2026:85312","RHSA-2026:85313","RHSA-2026:85317","RHSA-2026:85319","RHSA-2026:85322","RHSA-2026:85324","RHSA-2026:85325","RLSA-2026:85306","RLSA-2026:85308","RLSA-2026:85309","UBUNTU-CVE-2026-87766","USN-8779-1","openSUSE-SU-2026:11873-1"],"status":"published","title":"Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup","description":"A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00211,"percentile":0.1146,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2026-09-02T16:59:28Z","modified":"2026-11-03T02:31:00Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"bubblewrap","fixed_in":["0.4.0-3.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"bubblewrap","fixed_in":["0.10.0-5.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"bubblewrap","fixed_in":["0.6.3-1.el9_8.1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"bubblewrap","fixed_in":["0.12.0-1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"bubblewrap","fixed_in":["0.2.1-1ubuntu0.1+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"bubblewrap","fixed_in":["0.12.0-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"bubblewrap","fixed_in":["0.12.0-1"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"bubblewrap","fixed_in":["0.12.0-1.mga10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bubblewrap","fixed_in":["0:0.4.0-3.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bubblewrap-debuginfo","fixed_in":["0:0.4.0-3.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bubblewrap-debugsource","fixed_in":["0:0.4.0-3.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"bubblewrap","fixed_in":["0:0.10.0-5.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"bubblewrap-debuginfo","fixed_in":["0:0.10.0-5.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"bubblewrap-debugsource","fixed_in":["0:0.10.0-5.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bubblewrap","fixed_in":["0:0.6.3-1.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bubblewrap-debuginfo","fixed_in":["0:0.6.3-1.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bubblewrap-debugsource","fixed_in":["0:0.6.3-1.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"bubblewrap","fixed_in":["0:0.10.0-3.el10_0.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"bubblewrap-debuginfo","fixed_in":["0:0.10.0-3.el10_0.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"bubblewrap-debugsource","fixed_in":["0:0.10.0-3.el10_0.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"bubblewrap","fixed_in":["0:0.4.0-3.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"bubblewrap-debuginfo","fixed_in":["0:0.4.0-3.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"bubblewrap-debugsource","fixed_in":["0:0.4.0-3.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"bubblewrap","fixed_in":["0:0.4.0-3.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"bubblewrap-debuginfo","fixed_in":["0:0.4.0-3.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"bubblewrap-debugsource","fixed_in":["0:0.4.0-3.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"bubblewrap","fixed_in":["0:0.4.0-3.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"bubblewrap-debuginfo","fixed_in":["0:0.4.0-3.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"bubblewrap-debugsource","fixed_in":["0:0.4.0-3.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"bubblewrap","fixed_in":["0:0.4.0-3.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"bubblewrap-debuginfo","fixed_in":["0:0.4.0-3.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"bubblewrap-debugsource","fixed_in":["0:0.4.0-3.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"bubblewrap","fixed_in":["0:0.4.1-7.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"bubblewrap-debuginfo","fixed_in":["0:0.4.1-7.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"bubblewrap-debugsource","fixed_in":["0:0.4.1-7.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"bubblewrap","fixed_in":["0:0.4.1-7.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"bubblewrap-debuginfo","fixed_in":["0:0.4.1-7.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"bubblewrap-debugsource","fixed_in":["0:0.4.1-7.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"bubblewrap","fixed_in":["0:0.4.0-3.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"bubblewrap-debuginfo","fixed_in":["0:0.4.0-3.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"bubblewrap-debugsource","fixed_in":["0:0.4.0-3.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"bubblewrap","fixed_in":["0:0.4.0-3.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"bubblewrap-debuginfo","fixed_in":["0:0.4.0-3.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"bubblewrap-debugsource","fixed_in":["0:0.4.0-3.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"bubblewrap","fixed_in":["0:0.4.1-8.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"bubblewrap-debuginfo","fixed_in":["0:0.4.1-8.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"bubblewrap-debugsource","fixed_in":["0:0.4.1-8.el9_6.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"bubblewrap","fixed_in":["0:0.4.0-3.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"bubblewrap","fixed_in":["0:0.10.0-5.el10_2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"bubblewrap","fixed_in":["0:0.6.3-1.el9_8.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-3.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.0-5.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-1.el9_8.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.1-1ubuntu0.1+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.0+30+g0545e72-1","0.10.0-1","0.11.0-1","0.11.0-2","0.11.1-1","0.11.2-1","0.11.2-2","0.12.0+git20260914~bef077c-1","0.12.0-1","0.12.0-1~deb13u1","0.13.0-1","0.13.1-1","0.8.0-2","0.8.0-2+deb12u1","0.9.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-1~deb13u1"}]}],"versions":["0.11.0-2","0.11.0-2+deb13u1","0.11.1-1","0.11.2-1","0.11.2-2"]},{"source":"osv","ecosystem":"Debian:14","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-1"}]}],"versions":["0.11.0-2","0.11.1-1","0.11.2-1","0.11.2-2","0.12.0-1~deb13u1"]},{"source":"osv","ecosystem":"Mageia:10","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-1.mga10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-3.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bubblewrap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-3.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bubblewrap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-3.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.0-5.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"bubblewrap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.0-5.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"bubblewrap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.0-5.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.3-1.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bubblewrap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.3-1.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bubblewrap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.3-1.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.0-3.el10_0.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"bubblewrap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.0-3.el10_0.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"bubblewrap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.0-3.el10_0.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-3.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"bubblewrap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-3.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"bubblewrap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-3.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-3.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"bubblewrap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-3.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"bubblewrap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-3.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-3.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"bubblewrap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-3.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"bubblewrap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-3.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-3.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"bubblewrap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-3.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"bubblewrap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-3.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-7.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"bubblewrap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-7.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"bubblewrap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-7.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-7.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"bubblewrap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-7.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"bubblewrap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-7.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-3.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"bubblewrap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-3.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"bubblewrap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-3.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-3.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"bubblewrap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-3.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"bubblewrap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-3.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-8.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"bubblewrap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-8.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"bubblewrap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-8.el9_6.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-3.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.0-5.el10_2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.3-1.el9_8.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.0-1","0.2.0-2","0.2.0-4","0.2.1-1","0.2.1-1ubuntu0.1","0.2.1-1ubuntu0.1+esm2","0.2.1-1ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.3.3-2","0.4.0-1","0.4.0-1ubuntu1","0.4.0-1ubuntu2","0.4.0-1ubuntu3","0.4.0-1ubuntu4","0.4.0-1ubuntu4.1","0.4.0-1ubuntu4.1+esm2","0.4.0-1ubuntu4.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.1-3build1","0.5.0-1","0.6.0-1","0.6.1-1","0.6.1-1ubuntu0.1","0.6.1-1ubuntu0.2","0.6.1-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.0-2","0.9.0-1build1","0.9.0-1ubuntu0.1","0.9.0-1ubuntu0.2","0.9.0-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.0-2","0.11.0-2build1","0.11.1-1","0.11.1-1ubuntu0.1","0.11.1-1ubuntu0.2","0.11.1-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.1-1ubuntu0.1+esm2"}]}],"versions":["0.2.0-1","0.2.0-2","0.2.0-4","0.2.1-1","0.2.1-1ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-1ubuntu4.1+esm2"}]}],"versions":["0.3.3-2","0.4.0-1","0.4.0-1ubuntu1","0.4.0-1ubuntu2","0.4.0-1ubuntu3","0.4.0-1ubuntu4","0.4.0-1ubuntu4.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-1ubuntu0.2"}]}],"versions":["0.4.1-3build1","0.5.0-1","0.6.0-1","0.6.1-1","0.6.1-1ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.0-1ubuntu0.2"}]}],"versions":["0.8.0-2","0.9.0-1build1","0.9.0-1ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.1-1ubuntu0.2"}]}],"versions":["0.11.0-2","0.11.0-2build1","0.11.1-1","0.11.1-1ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.1"}]}],"bundled":2}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.0 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 telecommunications update service"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.2 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.6 extended update support"},{"vendor":"red hat","product":"red hat hardened images"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:85306","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:85308","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:85309","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:85312","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:85313","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:85317","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:85319","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:85322","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:85324","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:85325","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87766","tags":["vdb-entry","x_refsource_REDHAT","report","advisory"]},{"url":"https://bugs.debian.org/1145655","tags":["web","article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2530542","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://github.com/containers/bubblewrap/releases/tag/v0.12.0","tags":["web","article"]},{"url":"https://github.com/containers/bubblewrap/security/advisories/GHSA-pxhw-h44j-8pfx","tags":["advisory","article","report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/08/27/7","tags":["web","article"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/09/3","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/22/23","tags":["web"]},{"url":"https://bugzilla.redhat.com/2530542","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-85306.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-85308.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-85309.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87766","tags":["web","advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1791475845.html","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87766.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-87766","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0371.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36206","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00383.html","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85306.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87766","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85308.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85309.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85312.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85313.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85317.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85319.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85322.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85324.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85325.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:85306","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:85308","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:85309","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-87766","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8779-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-12439","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-87766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93676","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-87766","title":"Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup","description":"A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0.","status":"published","published":"2026-09-09T08:34:35.359Z","modified":"2026-11-02T13:30:15.908Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T18:00:08.034842Z"}],"euvd":[{"id":"EUVD-2026-74778","description":"A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0.","status":"published","published":"2026-09-09T08:34:35Z","modified":"2026-11-02T13:30:15Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:58:45.261111Z"}],"nvd":[{"id":"CVE-2026-87766","description":"A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0.","status":"published","published":"2026-09-09T09:17:12.54Z","modified":"2026-10-20T00:19:01.237Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:12:45.93749Z"}],"osv":[{"id":"CVE-2026-87766","title":"Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup","description":"A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0.","status":"published","published":"2026-09-09T08:34:35.359Z","modified":"2026-11-03T02:31:00.517313442Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-03T03:05:53.289262Z"},{"id":"DEBIAN-CVE-2026-87766","description":"A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0.","status":"published","published":"2026-09-09T09:17:12.54Z","modified":"2026-10-23T18:04:43.010222864Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:05.506112Z"},{"id":"RHSA-2026:85306","title":"Red Hat Security Advisory: bubblewrap security update","status":"published","published":"2026-10-20T10:18:06Z","modified":"2026-10-20T10:32:25.283234757Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:85308","title":"Red Hat Security Advisory: bubblewrap security update","status":"published","published":"2026-10-20T10:18:07Z","modified":"2026-10-20T10:31:26.045750177Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:85309","title":"Red Hat Security Advisory: bubblewrap security update","status":"published","published":"2026-10-20T10:18:07Z","modified":"2026-10-20T10:31:26.037307592Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:85312","title":"Red Hat Security Advisory: bubblewrap security update","status":"published","published":"2026-10-20T10:18:08Z","modified":"2026-10-20T10:31:26.045704913Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:85313","title":"Red Hat Security Advisory: bubblewrap security update","status":"published","published":"2026-10-20T10:18:08Z","modified":"2026-10-20T10:31:26.042499306Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:85317","title":"Red Hat Security Advisory: bubblewrap security update","status":"published","published":"2026-10-20T10:18:09Z","modified":"2026-10-20T10:32:25.282518242Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:85319","title":"Red Hat Security Advisory: bubblewrap security update","status":"published","published":"2026-10-20T10:18:09Z","modified":"2026-10-20T10:31:26.050238395Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:85322","title":"Red Hat Security Advisory: bubblewrap security update","status":"published","published":"2026-10-20T10:18:11Z","modified":"2026-10-20T10:31:43.071289149Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:85324","title":"Red Hat Security Advisory: bubblewrap security update","status":"published","published":"2026-10-20T10:18:11Z","modified":"2026-10-20T10:31:31.655911794Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:85325","title":"Red Hat Security Advisory: bubblewrap security update","status":"published","published":"2026-10-20T10:18:12Z","modified":"2026-10-20T10:31:26.039680899Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:85306","title":"Important: bubblewrap security update","description":"Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces.\n\nSecurity Fix(es):\n\n* bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup (CVE-2026-87766)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-21T06:37:12.817086Z","modified":"2026-10-21T07:15:10.487710593Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:85308","title":"Important: bubblewrap security update","description":"Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces.\n\nSecurity Fix(es):\n\n* bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup (CVE-2026-87766)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-21T12:08:45.400552Z","modified":"2026-10-21T12:30:02.604102431Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:85309","title":"Important: bubblewrap security update","description":"Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces.\n\nSecurity Fix(es):\n\n* bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup (CVE-2026-87766)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-21T06:40:55.719656Z","modified":"2026-10-21T07:15:06.08545949Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"UBUNTU-CVE-2026-87766","description":"A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0.","status":"published","published":"2026-09-09T09:17:00Z","modified":"2026-09-18T01:00:10.531832228Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"ALSA-2026:85306","title":"Important: bubblewrap security update","description":"Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces.  \n\nSecurity Fix(es):  \n\n  * bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup (CVE-2026-87766)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-19T00:00:00Z","modified":"2026-10-29T11:02:25.349674077Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:85308","title":"Important: bubblewrap security update","description":"Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces.  \n\nSecurity Fix(es):  \n\n  * bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup (CVE-2026-87766)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-19T00:00:00Z","modified":"2026-10-29T11:31:00.407849661Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:85309","title":"Important: bubblewrap security update","description":"Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces.  \n\nSecurity Fix(es):  \n\n  * bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup (CVE-2026-87766)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-19T00:00:00Z","modified":"2026-10-29T11:32:38.262190184Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-100908","title":"CVE-2026-87766 affecting package bubblewrap for versions less than 0.12.0-1","description":"A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0.","status":"published","published":"2026-09-09T09:17:12Z","modified":"2026-09-23T14:15:41.100349682Z","updated_at":"2026-11-02T15:28:00.253976Z"},{"id":"CLSA-2026-1791475845","title":"Fix CVE(s): CVE-2026-87766","description":"   * SECURITY UPDATE: symlink traversal during sandbox setup lets a crafted\n     source tree redirect file/dir creation and mounts outside the sandbox\n     (sandbox escape)\n     - debian/patches/CVE-2026-87766.patch: resolve every destination inside\n       /newroot and every source inside /oldroot a component at a time\n       (safe_openat in utils.c), create and mount through O_PATH|O_NOFOLLOW fds\n       passed to the privileged helper (bind_mount_fd), and refuse to mount on\n       a symlink destination (bubblewrap.c, bind-mount.c, utils.c)\n     - CVE-2026-87766","status":"published","published":"2026-10-08T23:16:00Z","modified":"2026-10-26T09:32:04.621085387Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"MGASA-2026-0371","title":"Updated bubblewrap package fixes security vulnerabilities","description":"Sandbox escape: symlink traversal via /oldroot allows writing files\noutside sandbox during setup\n","status":"published","published":"2026-09-02T16:59:28Z","modified":"2026-09-13T05:45:03.425567869Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11873-1","title":"flatpak-1.18.3-1.1 on GA media","description":"These are all security issues fixed in the flatpak-1.18.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-24T00:00:00Z","modified":"2026-09-25T18:23:08.574862627Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"USN-8779-1","title":"bubblewrap vulnerabilities","description":"It was discovered that Bubblewrap incorrectly handled certain temporary\ndirectories. A local attacker could possibly use this issue to cause a\ndenial of service or execute arbitrary code. This issue only affected\nUbuntu 18.04 LTS. (CVE-2019-12439)\n\nIt was discovered that Bubblewrap incorrectly handled certain symlinks\nduring sandbox setup. A local attacker could possibly use this issue to\ncreate files outside of the sandbox. (CVE-2026-87766)","status":"published","published":"2026-09-17T15:50:32Z","modified":"2026-09-18T23:56:34.184582731Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}