Threat database

A security vulnerability (CVE-2026-87766) affects bubblewrap, a core execution engine for unprivileged containers used as a setuid binary on kernels without user namespaces. The flaw involves a symlink traversal via /oldroot that allows writing files outside the intended sandbox during setup. Red Hat has issued an important security update for bubblewrap in Red Hat Enterprise Linux 9.6 Extended Update Support and related variants to address this issue.

CVE-2024-42472 is a security vulnerability in bubblewrap and flatpak on Red Hat Enterprise Linux 9 that allows applications using the persistent= (--persist) option in flatpak to access files outside their sandbox, potentially breaking container isolation. Bubblewrap is a core execution engine for unprivileged containers and runs as a setuid binary on kernels without user namespaces. Red Hat has issued an important security update to address this issue.