Link following in Bubblewrap - CVE-2026-87766

Vulnerability identifier: #VU145997

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-87766

CWE-ID: CWE-59

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to write files outside the sandbox.

The vulnerability exists due to improper link resolution before file access in the bubblewrap sandbox setup logic when creating files or directories on attacker-controlled filesystem content. A local user can use symlinks that redirect through /oldroot to write files outside the sandbox.

This issue occurs during sandbox setup before anything is running inside the sandbox, and exploitation requires bubblewrap to create files on attacker-controlled filesystem content such as a malicious app image.

Bubblewrap
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
bubblewrap (Red Hat package)
bubblewrap (Ubuntu package)
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Ubuntu

Install security update from vendor's website.

Bubblewrap - update to 0.12.0
bubblewrap (Red Hat package) - addressed in versions 0.4.0-3.el8_6, 0.4.0-3.el8_8, 0.4.0-3.el8_10, 0.4.1-8.el9_6.1, 0.6.3-1.el9_8.1, 0.10.0-3.el10_0.4, 0.10.0-5.el10_2
bubblewrap (Ubuntu package) - addressed in versions 0.2.1-1ubuntu0.1+esm2, 0.2.1-1ubuntu0.1+esm3, 0.4.0-1ubuntu4.1+esm2, 0.4.0-1ubuntu4.1+esm3, 0.6.1-1ubuntu0.2, 0.9.0-1ubuntu0.2, 0.11.1-1ubuntu0.2

• https://github.com/containers/bubblewrap/security/advisories/GHSA-pxhw-h44j-8pfx

• Link following in Bubblewrap
• Ubuntu update for bubblewrap
• Ubuntu update for bubblewrap
• Red Hat Enterprise Linux 8 update for bubblewrap
• Red Hat Enterprise Linux 10 update for bubblewrap
• Red Hat Enterprise Linux 9 update for bubblewrap
• Red Hat Enterprise Linux 10 update for bubblewrap
• Red Hat Enterprise Linux 8 update for bubblewrap
• Red Hat Enterprise Linux 8 update for bubblewrap
• Red Hat Enterprise Linux 9 update for bubblewrap