Improper privilege management in Bubblewrap - CVE-2026-41163
Published: April 23, 2026
Vulnerability identifier: #VU126913
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-41163
CWE-ID: CWE-269
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Project Atomic
Affected software:
Bubblewrap
Bubblewrap
Detailed vulnerability description
The vulnerability allows a local user to escalate privileges.
The vulnerability exists due to improper access control in setuid mode when handling ptrace attachment during the sandbox setup phase. A local user can attach to bubblewrap with ptrace and control the unprivileged part of the sandbox setup phase to escalate privileges.
Only installations running in setuid mode are vulnerable, and exploitation is possible in configurations that support overlayfs mounts.
How to mitigate CVE-2026-41163
Install security update from vendor's website.