RHSA-2026:98521: Important: bubblewrap security update
Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces.Security Fix(es): bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup (CVE-2026-87766) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/bubblewrapto a version that resolves this vulnerability.Fixed in 0.6.3-1.el9_9.1 - Upgrade
Upgrade
redhat/bubblewrap-debuginfoto a version that resolves this vulnerability.Fixed in 0.6.3-1.el9_9.1 - Upgrade
Upgrade
redhat/bubblewrap-debugsourceto a version that resolves this vulnerability.Fixed in 0.6.3-1.el9_9.1 - Upgrade
Upgrade
redhat/bubblewrapto a version that resolves this vulnerability.Fixed in 0.6.3-1.el9_9.1.aa - Upgrade
Upgrade
redhat/bubblewrap-debuginfoto a version that resolves this vulnerability.Fixed in 0.6.3-1.el9_9.1.aa - Upgrade
Upgrade
redhat/bubblewrap-debugsourceto a version that resolves this vulnerability.Fixed in 0.6.3-1.el9_9.1.aa
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Deployments using Bubblewrap as a setuid binary on kernels without user namespaces are specifically described as affected by the relevant execution mode. The issue involves /usr/bin/bwrap, which is used as a core execution engine for unprivileged containers.
What could exploitation allow?
The flaw is a symlink traversal involving /oldroot during sandbox setup. It can allow files to be written outside the intended sandbox.
How can I identify whether the affected component is installed?
Check whether the Bubblewrap package is installed and whether /usr/bin/bwrap is present. The advisory also lists redhat/bubblewrap-debuginfo and redhat/bubblewrap-debugsource as related software packages.