CVE-2026-41163highCWE-269

CVE-2026-41163: high-severity vulnerability in containers bubblewrap

bubblewrap vulnerable to privilege escalation in setuid mode via ptrace

Published · Updated

Follow this CVE+ Monitor bubblewrap+ Monitor bubblewrap

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.3%
bubblewrap is a low-level unprivileged sandboxing tool. From version 0.11.0 to before version 0.11.2, if bubblewrap is installed in setuid mode then the user can use ptrace to attach to bubblewrap and control the unprivileged part of the sandbox setup phase. This allows the attacker to arbitrarily use the privileged operations, and in particular the "overlay mount" operation, allowing the creation of overlay mounts which is otherwise not allowed in the setuid version of bubblewrap. This issue has been patched in version 0.11.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
containers · bubblewrap
Related CVEs — containers bubblewrap

In the same product, most dangerous first.

CVE-2020-5291HIGHPrivilege escalation in setuid mode via user namespaces in BubblewrapEPSS 0.9%