CVE-2026-87766 Overview
A symlink-following flaw in bubblewrap allows a local attacker to write files outside the sandbox during setup. The vulnerability, tracked as GHSA-pxhw-h44j-8pfx, occurs when bubblewrap creates files or directories under the new root and follows a parent symlink onto the host through /oldroot. The result is that attacker-chosen paths are written on the host as the launching user, before the sandboxed process even starts. The issue affects bubblewrap versions prior to 0.12.0 and is classified under CWE-59: Improper Link Resolution Before File Access.
Critical Impact
A local user can escape the bubblewrap sandbox during initialization and write arbitrary files on the host filesystem with the privileges of the invoking user, potentially leading to privilege escalation or persistence.
Affected Products
- bubblewrap versions prior to 0.12.0
- Linux distributions packaging vulnerable bubblewrap builds (Red Hat, Debian, and derivatives)
- Applications relying on bubblewrap for sandboxing, including Flatpak-based deployments
Discovery Timeline
- 2026-09-09 - CVE CVE-2026-87766 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-87766
Vulnerability Analysis
Bubblewrap is an unprivileged sandboxing tool used by Flatpak and other container-style runtimes on Linux. During sandbox initialization, bubblewrap constructs a new root filesystem and preserves access to the original host root through /oldroot. The vulnerable code path creates files or directories under the new root without validating that a parent component is not a symlink pointing back through /oldroot to the host.
Because file creation happens before the sandboxed process starts, all filesystem operations run with the launching user's credentials on the host namespace. An attacker controlling paths inside the sandbox definition can traverse a symlink to write outside the intended sandbox boundary. This breaks the fundamental containment guarantee bubblewrap is designed to provide.
Root Cause
The flaw is a link-following weakness [CWE-59] in bubblewrap's sandbox setup logic. File and directory creation operations do not use symlink-safe primitives such as O_NOFOLLOW on every path component, and they do not verify that resolved paths remain under the new root. When a parent directory in the target path is a symlink into /oldroot, the operation silently follows it into the host filesystem.
Attack Vector
The attack requires local access and the ability to influence the sandbox setup, such as by controlling bind mount sources, environment configuration, or crafted filesystem contents that bubblewrap processes. The attacker plants a symlink whose parent path resolves through /oldroot, then triggers bubblewrap to create a file or directory at that path. Bubblewrap writes the attacker-chosen content or directory outside the sandbox, on the host, as the user launching the sandbox. See the GitHub Security Advisory GHSA-pxhw-h44j-8pfx for the technical write-up.
Detection Methods for CVE-2026-87766
Indicators of Compromise
- Unexpected files or directories created in user-writable paths (for example ~/.config, ~/.local, or ~/.ssh) immediately after a bubblewrap or Flatpak invocation.
- Symlinks inside sandbox source trees whose targets resolve through /oldroot or otherwise escape the intended root.
- Bubblewrap invocations referencing binaries with versions earlier than 0.12.0 on production hosts.
Detection Strategies
- Audit installed bubblewrap versions across the fleet and flag any host running a release earlier than 0.12.0.
- Monitor execve events for bwrap and correlate with subsequent openat or mkdirat calls that write outside expected sandbox roots.
- Review Flatpak and portal application manifests for user-supplied bind mounts that could carry attacker-controlled symlinks.
Monitoring Recommendations
- Enable Linux audit rules on file creation syscalls in sensitive directories, filtered by the parent process being bwrap.
- Ingest process and file telemetry into a central data lake and alert on writes to host paths originating from sandbox setup phases.
- Track package inventory changes so that downgrades of bubblewrap below 0.12.0 are surfaced as configuration drift.
How to Mitigate CVE-2026-87766
Immediate Actions Required
- Upgrade bubblewrap to version 0.12.0 or later on all Linux systems where it is installed.
- Apply distribution security updates from vendors including Red Hat and the Debian maintainers.
- Inventory all applications that embed or depend on bubblewrap, including Flatpak, and confirm they consume the patched version.
Patch Information
The issue is fixed in bubblewrap 0.12.0. The upstream project addressed the symlink-following behavior during sandbox setup so that file and directory creation no longer traverses parent symlinks into /oldroot. Refer to the GitHub Security Advisory GHSA-pxhw-h44j-8pfx and the OpenWall OSS-Security discussion for coordinated details.
Workarounds
- Restrict local user access on multi-tenant hosts until the patched package is deployed.
- Avoid launching bubblewrap-based sandboxes against untrusted filesystem trees that may contain attacker-controlled symlinks.
- Where feasible, disable or gate Flatpak application installation from untrusted sources until systems are upgraded to bubblewrap 0.12.0 or later.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.