CVE-2026-41163

HighCVSS 7.0/10Last modified Aug 24, 2026

Description

bubblewrap is a low-level unprivileged sandboxing tool. From version 0.11.0 to before version 0.11.2, if bubblewrap is installed in setuid mode then the user can use ptrace to attach to bubblewrap and control the unprivileged part of the sandbox setup phase. This allows the attacker to arbitrarily use the privileged operations, and in particular the "overlay mount" operation, allowing the creation of overlay mounts which is otherwise not allowed in the setuid version of bubblewrap. This issue has been patched in version 0.11.2.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published: May 9, 2026
Last modified: Aug 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-411644.4nuts-node is the reference implementation of the Nuts specification. Prior to 6.2.3 and 5.4.31, the v1 access token introspection endpoint (CVE-2026-411667.0OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.1, a user who has `write:admin` in one Keycloak realm can ca CVE-2026-411679.1Jellystat is a free and open source Statistics App for Jellyfin. Prior to version 1.1.10, multiple API endpoints in Jellystat build SQL quer CVE-2026-411685.3pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.1 can craft CVE-2026-41175.3The CalJ plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5. This is due to a missing cap CVE-2026-411707.2Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the `RestoreController.Pos CVE-2026-411717.3Squidex is an open source headless content management system and content management hub. Versions prior to 7.23.0 have a Server-Side Request CVE-2026-411727.3Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, an SSRF vulnerability allo CVE-2026-411735.9The AWS X-Ray Remote Sampler package provides a sampler which can get sampling configurations from AWS X-Ray. Prior to 0.1.0-alpha.8, OpenTe CVE-2026-411746.4Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a potential vulnerability in CVE-2026-411758.1Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.20 and 6.13.0, manipulating query parameters o CVE-2026-411769.8Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set`