SEPTEMBER 15, 2026
Live Feed
Back to database
Case File

CVE-2026-87766

HIGH · CVSS 8.8 EPSS 0.14% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-09 · Last synced 2026-09-15

CyberRota Analysis

AI-Generated

A vulnerability in bubblewrap allows an attacker to create files or directories outside the sandbox by exploiting a symlink during the sandbox setup process, potentially leading to unauthorized access or modification of host files. This flaw poses a high risk, particularly for environments that rely on bubblewrap for container isolation. Organizations using bubblewrap should prioritize updating to version 0.12.0 to mitigate this risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-87766
Severity
HIGH
CVSS
8.8
EPSS
0.14%

Original NVD Description

A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0.