CVE-2026-87766: Improper Link Resolution Before File Access ('Link Following') in Red Hat Red Hat Enterprise Linux 10
Affects Red Hat Red Hat Enterprise Linux 10Source CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Red HatRed Hat Enterprise Linux 10 | Affected– | Fixed in– |
| Red HatRed Hat Enterprise Linux 10.0 Extended Update Support | Affected– | Fixed in– |
| Red HatRed Hat Enterprise Linux 8 | Affected– | Fixed in– |
| Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | Affected– | Fixed in– |
| Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | Affected– | Fixed in– |
| Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | Affected– | Fixed in– |
| Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | Affected– | Fixed in– |
| Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service | Affected– | Fixed in– |
| Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions | Affected– | Fixed in– |
| Red HatRed Hat Enterprise Linux 9 | Affected– | Fixed in– |
| Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions | Affected– | Fixed in– |
| Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions | Affected– | Fixed in– |
| Red HatRed Hat Enterprise Linux 9.6 Extended Update Support | Affected– | Fixed in– |
| Red HatRed Hat Hardened Images | Affected– | Fixed in– |
GitHub Actionscontainers/bubblewrappkg:github/containers/bubblewrapOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A fixed version of bubblewrap (0.12.0) is available and should be applied to affected Red Hat Enterprise Linux 10 systems. The vendor advisory RHSA-2026:85308 provides update instructions. Applying this update remediates the symlink traversal vulnerability. No additional mitigations are specified or required beyond applying the official patch.
Description
CVE-2026-87766 is a high severity vulnerability in bubblewrap used by Red Hat Enterprise Linux 10. It involves improper link resolution during sandbox setup, allowing symlink traversal via /oldroot. This flaw can cause files or directories to be created outside the sandbox with the launching user's privileges before the sandboxed process starts. The issue is fixed in bubblewrap version 0.12.0.
Impact
Successful exploitation allows an attacker with limited privileges to write files outside the intended sandbox environment with the launching user's permissions. This can lead to unauthorized modification or creation of files on the host system, potentially compromising system integrity and confidentiality. The vulnerability affects the setup phase before sandbox isolation is enforced, increasing risk of host compromise.
Summary
The vulnerability CVE-2026-87766 affects bubblewrap, a core execution engine for unprivileged containers in Red Hat Enterprise Linux 10. During sandbox setup, creating files or directories under the new root can follow a parent symbolic link through /oldroot, enabling writes to attacker-chosen paths outside the sandbox as the launching user. This occurs before the sandboxed process starts, potentially compromising the host environment. The flaw is identified as a symlink traversal issue and is resolved in bubblewrap version 0.12.0. The Red Hat advisory rates this as an important security update with a CVSS 3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability.
References
- access.redhat.com/security/cve/CVE-2026-87766 (opens in a new tab)
- bugs.debian.org/1145655 (opens in a new tab)
- bugzilla.redhat.com/show_bug.cgi?id=2530542 (opens in a new tab)
- github.com/containers/bubblewrap/releases/tag/v0.12.0 (opens in a new tab)
- github.com/containers/bubblewrap/security/advisories/GHSA-pxhw-h44j-8pfx (opens in a new tab)
- openwall.com/lists/oss-security/2026/08/27/7 (opens in a new tab)
- openwall.com/lists/oss-security/2026/09/09/3 (opens in a new tab)
- openwall.com/lists/oss-security/2026/09/22/23 (opens in a new tab)
- access.redhat.com/errata/RHSA-2026:85308 (opens in a new tab)
- access.redhat.com/errata/RHSA-2026:85313 (opens in a new tab)
- access.redhat.com/errata/RHSA-2026:85317 (opens in a new tab)
- access.redhat.com/errata/RHSA-2026:85319 (opens in a new tab)
- access.redhat.com/errata/RHSA-2026:85324 (opens in a new tab)
- access.redhat.com/errata/RHSA-2026:85325 (opens in a new tab)
- access.redhat.com/errata/RHSA-2026:85309 (opens in a new tab)
- access.redhat.com/errata/RHSA-2026:85306 (opens in a new tab)
- access.redhat.com/errata/RHSA-2026:85312 (opens in a new tab)
- access.redhat.com/errata/RHSA-2026:85322 (opens in a new tab)