CVE-2026-41163: containers bubblewrap Improper Privilege Management
Vulnerability summary
CVE-2026-41163 is a high (CVSS 8.7) Improper Privilege Management vulnerability in containers bubblewrap. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 28.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 09-05-2026PublishedVulnerability first disclosed.
- 01-09-2026Last modifiedVulnerability information updated.
Description
bubblewrap is a low-level unprivileged sandboxing tool. From version 0.11.0 to before version 0.11.2, if bubblewrap is installed in setuid mode then the user can use ptrace to attach to bubblewrap and control the unprivileged part of the sandbox setup phase. This allows the attacker to arbitrarily use the privileged operations, and in particular the "overlay mount" operation, allowing the creation of overlay mounts which is otherwise not allowed in the setuid version of bubblewrap. This issue has been patched in version 0.11.2.
CVSS metrics
9 scores · 6 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · Red hatEcosystem advisory · calculated7.0HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.0HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.0HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.36%
Chance of exploitation in the next 30 days
Percentile
28%
Versus all other CVEs
30-day change
+0.09 pp
From 0.27% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- bubblewrapAll versions (No fix recorded)
Containers1 product
- bubblewrap≥ 0.11.0, < 0.11.2
Debian1 product
- bubblewrap< 0.11.0-2+deb13u1 | < 0.11.2-1
Opensuse1 product
- bubblewrap&distro=openSUSE Tumbleweed< 0.11.2-1.1
Redhat1 product
- bubblewrap< 0:0.12.0-1.hum1
Ubuntu1 product
- bubblewrap< 0.11.0-2ubuntu0.1 | < 0.11.1-1ubuntu0.1
6 vendors · 6 products
References
16 links- images.redhat.comARTICLE
