Red Hat Security Advisory: bubblewrap security update

Bubblewrap (/usr/bin/bwrap) is a setuid binary used as a core execution engine for unprivileged containers on kernels lacking user namespaces. The vulnerability CVE-2026-87766 is a symlink traversal flaw via /oldroot that permits an attacker to write files outside the sandbox during the container setup phase. This could potentially allow unauthorized modification of files on the host system. Red Hat has released an update for bubblewrap in Red Hat Enterprise Linux 9.6 Extended Update Support and related product variants to fix this issue.

The vulnerability allows writing files outside the sandbox during setup, which could lead to unauthorized file modifications on the host system. This compromises the isolation guarantees provided by bubblewrap containers, potentially enabling privilege escalation or host system compromise. The severity is rated as important by Red Hat Product Security.

Red Hat has released an official security update for bubblewrap to address CVE-2026-87766. Users of affected Red Hat Enterprise Linux 9.6 Extended Update Support and related variants should apply the update as described in the Red Hat advisory (https://access.redhat.com/articles/11258). No additional mitigation steps are indicated beyond applying the vendor-provided patch.