CVE-2026-87766— Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
bubblewrap 中发现了一个缺陷。在沙箱初始化阶段，在新根目录（new root）下创建文件或目录时，可能会通过 跟随指向宿主机的父级符号链接，从而以启动用户的身份将攻击者指定的路径写入沙箱外部。该问题发生在沙箱化进程启动之前。此问题对应 GitHub 安全公告编号 GHSA-pxhw-h44j-8pfx，已在 bubblewrap 0.12.0 版本中修复。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-87766
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在文件访问前对链接解析不恰当(链接跟随)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Hardened Images | - |
cpe:/a:redhat:hummingbird:1
|
|
II. Public POCs for CVE-2026-87766
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-87766
请登录查看更多情报信息。
Other References for CVE-2026-87766 (6)
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-18090
Gdk-pixbuf: gdk-pixbuf: heap out-of-bounds read in uncompres -
CVE-2026-74860
Libxml2: double-free/uaf in libxml2 python bindings -
CVE-2026-86469
Glib2: toctou symlink race in `g_file_create_replace_destina -
CVE-2026-79678
Freeipa: idm: freeipa: idp-add eval() reachable before autho -
CVE-2026-76578
Ipa: freeipa: freeipa: unauthenticated ldap client can obtai
Same vendor: Red Hat
-
CVE-2026-19729
Keycloak-services: keycloak-services: incomplete fix for arb -
CVE-2026-86564
Dpdk: dpdk: missing length validation before reading command -
CVE-2026-18090
Gdk-pixbuf: gdk-pixbuf: heap out-of-bounds read in uncompres -
CVE-2026-80219
Hawtio-operator: hawtio-operator: oauthclient created with g -
CVE-2026-78234
Hawtio-operator: hawtio-operator: service-ca signing oracle
Same weakness: CWE-59
-
CVE-2026-78622
Improper Link Resolution in Okta Verify for Windows Uninstal -
CVE-2026-81963
Windows Update Stack Elevation of Privilege Vulnerability -
CVE-2026-69425
Windows NTFS Tampering Vulnerability -
CVE-2026-69289
Windows Setup Files Cleanup Elevation of Privilege Vulnerabi -
CVE-2026-83999
Windows Resilient File System (ReFS) Deduplication Service E
V. Comments for CVE-2026-87766
No comments yet