Bug 2530542 (CVE-2026-87766) - CVE-2026-87766 bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup
Summary: CVE-2026-87766 bubblewrap: bubblewrap: symlink traversal via /oldroot allows ...
Keywords:
Status: NEW
Alias: CVE-2026-87766
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-09 08:08 UTC by OSIDB Bzimport
Modified: 2026-11-11 12:10 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:85306 0 None None None 2026-10-19 21:14:37 UTC
Red Hat Product Errata RHSA-2026:85308 0 None None None 2026-10-19 20:48:45 UTC
Red Hat Product Errata RHSA-2026:85309 0 None None None 2026-10-19 21:22:30 UTC
Red Hat Product Errata RHSA-2026:85312 0 None None None 2026-10-19 20:58:58 UTC
Red Hat Product Errata RHSA-2026:85313 0 None None None 2026-10-19 21:18:56 UTC
Red Hat Product Errata RHSA-2026:85317 0 None None None 2026-10-19 21:14:12 UTC
Red Hat Product Errata RHSA-2026:85319 0 None None None 2026-10-19 21:20:22 UTC
Red Hat Product Errata RHSA-2026:85322 0 None None None 2026-10-19 21:24:43 UTC
Red Hat Product Errata RHSA-2026:85324 0 None None None 2026-10-19 21:15:02 UTC
Red Hat Product Errata RHSA-2026:85325 0 None None None 2026-10-19 21:21:49 UTC
Red Hat Product Errata RHSA-2026:98521 0 None None None 2026-11-11 12:10:30 UTC

Description OSIDB Bzimport 2026-09-09 08:08:28 UTC 
A flaw was found in bubblewrap. During sandbox setup the host filesystem is mounted at /oldroot and the sandboxed root is mounted at /newroot. When bubblewrap creates a file or directory under /newroot, it can follow a parent symlink that points at /oldroot, causing that object to be created on the host instead of inside the sandbox. This occurs during setup, before any sandboxed process is running. Created files use the uid and gid of the user that launched bubblewrap, which is typically unprivileged. The issue affects Flatpak when a malicious or compromised application image is used, and can affect other frameworks that create files on untrusted content with bubblewrap. This vulnerability is tracked by upstream as GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0 by resolving paths with openat2 and RESOLVE_IN_ROOT.
Comment 2 Simon McVittie 2026-09-09 11:37:31 UTC 
The upstream advisory is <https://github.com/containers/bubblewrap/security/advisories/GHSA-pxhw-h44j-8pfx>.

In supported Fedora branches, I believe this was already fixed by updating to 0.12.0 (but I'm not a Fedora developer and I don't know which branches have what support status).
Comment 4 Jon Orris 2026-10-19 20:48:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:85308 https://access.redhat.com/errata/RHSA-2026:85308
Comment 5 Jon Orris 2026-10-19 20:58:57 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:85312 https://access.redhat.com/errata/RHSA-2026:85312
Comment 6 Jon Orris 2026-10-19 21:14:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:85317 https://access.redhat.com/errata/RHSA-2026:85317
Comment 7 Jon Orris 2026-10-19 21:14:36 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:85306 https://access.redhat.com/errata/RHSA-2026:85306
Comment 8 Jon Orris 2026-10-19 21:15:01 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:85324 https://access.redhat.com/errata/RHSA-2026:85324
Comment 9 Jon Orris 2026-10-19 21:18:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:85313 https://access.redhat.com/errata/RHSA-2026:85313
Comment 10 Jon Orris 2026-10-19 21:20:21 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:85319 https://access.redhat.com/errata/RHSA-2026:85319
Comment 11 Jon Orris 2026-10-19 21:21:48 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:85325 https://access.redhat.com/errata/RHSA-2026:85325
Comment 12 Jon Orris 2026-10-19 21:22:29 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:85309 https://access.redhat.com/errata/RHSA-2026:85309
Comment 13 Jon Orris 2026-10-19 21:24:42 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:85322 https://access.redhat.com/errata/RHSA-2026:85322
Comment 14 errata-xmlrpc 2026-11-11 12:10:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:98521 https://access.redhat.com/errata/RHSA-2026:98521
Note You need to log in before you can comment on or make changes to this bug.