Vulnerability Intelligence Report
Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup
CVE-2026-87766
A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0.
No Active Exploit Signals
CVSS Base Score
8.8
HIGH
Exploitability:2.1
Impact Score:6.1
EPSS Probability:0.21%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-59 ↗Improper Link Resolution Before File Access
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | 0:0.10.0-5.el10_2 < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | 0:0.10.0-3.el10_0.4 < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 8 | 0:0.4.0-3.el8_10 < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | 0:0.4.0-3.el8_4 < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | 0:0.4.0-3.el8_4 < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | 0:0.4.0-3.el8_6 < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | 0:0.4.0-3.el8_6 < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | 0:0.4.0-3.el8_8 < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | 0:0.4.0-3.el8_8 < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 9 | 0:0.6.3-1.el9_8.1 < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | 0:0.4.1-7.el9_2.1 < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | 0:0.4.1-7.el9_4.1 < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | 0:0.4.1-8.el9_6.1 < * (unaffected) |
| Red Hat | Red Hat Hardened Images | all |
Threat Intelligence Signals
EPSS Score
0.211%
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Red Hat, Inc. · Vendor · USA |
| Reserved | 2026-09-09T08:08:33 |
| Published | 2026-09-09T08:34:35 |
| Patch Date | 2026-09-09 |
| Last Updated | 2026-11-02T13:30:15 |
Community Chatter & Buzz