Vulnerability in Red Hat Enterprise Linux 10

[ Description ]Official description

A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund19 Oct 2026WID-SEC-2026-4029

  Red Hat Enterprise Linux (python-tornado, resteasy-core, bubblewrap, pgvector): Multiple vulnerabilities Translated from German

  Risk highCVE-2026-89059CVE-2026-82397CVE-2026-87766+3 more CVEs

[ References ]References

• access.redhat.com/errata/RHSA-2026:85306vendor-advisoryx_refsource_REDHAT
• access.redhat.com/errata/RHSA-2026:85308vendor-advisoryx_refsource_REDHAT
• access.redhat.com/errata/RHSA-2026:85309vendor-advisoryx_refsource_REDHAT
• access.redhat.com/errata/RHSA-2026:85312vendor-advisoryx_refsource_REDHAT
• access.redhat.com/errata/RHSA-2026:85313vendor-advisoryx_refsource_REDHAT
• access.redhat.com/errata/RHSA-2026:85317vendor-advisoryx_refsource_REDHAT
• access.redhat.com/errata/RHSA-2026:85319vendor-advisoryx_refsource_REDHAT
• access.redhat.com/errata/RHSA-2026:85322vendor-advisoryx_refsource_REDHAT
• access.redhat.com/errata/RHSA-2026:85324vendor-advisoryx_refsource_REDHAT
• access.redhat.com/errata/RHSA-2026:85325vendor-advisoryx_refsource_REDHAT
• access.redhat.com/security/cve/CVE-2026-87766vdb-entryx_refsource_REDHAT
• bugs.debian.org/1145655
• bugzilla.redhat.com/show_bug.cgiissue-trackingx_refsource_REDHAT
• github.com/containers/bubblewrap/releases/tag/v0.12.0
• github.com/containers/bubblewrap/security/advisories/GHSA-pxhw-h44j-8pfx
• www.openwall.com/lists/oss-security/2026/08/27/7