RHSA-2026:85306HighCVSS 8.8
Red Hat Security Advisory: bubblewrap security update
🔗 CVE IDs covered (1)
📋 Description
CVE-2026-87766 — bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup
🎯 Affected products14
- Red Hat Enterprise Linux BaseOS (v. 8)
- bubblewrap-0:0.4.0-3.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
- bubblewrap-0:0.4.0-3.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
- bubblewrap-0:0.4.0-3.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
- bubblewrap-0:0.4.0-3.el8_10.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)
- bubblewrap-0:0.4.0-3.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
- bubblewrap-debuginfo-0:0.4.0-3.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
- bubblewrap-debuginfo-0:0.4.0-3.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
- bubblewrap-debuginfo-0:0.4.0-3.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
- bubblewrap-debuginfo-0:0.4.0-3.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
- bubblewrap-debugsource-0:0.4.0-3.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
- bubblewrap-debugsource-0:0.4.0-3.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
- bubblewrap-debugsource-0:0.4.0-3.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
- bubblewrap-debugsource-0:0.4.0-3.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
✅ Remediation
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Do not create files on untrusted content with unpatched bwrap. Do not install untrusted Flatpaks. No upstream fix for older setuid builds.