CVE-2026-41163
Privilege Escalation in Bubblewrap via Ptrace
Publication date: 2026-05-09
Last updated on: 2026-05-09
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| containers | bubblewrap | From 0.11.0 (inc) to 0.11.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-41163 is a vulnerability in bubblewrap, a low-level unprivileged sandboxing tool. When bubblewrap is installed in setuid mode (versions 0.11.0 to before 0.11.2), an attacker can use the ptrace system call to attach to the bubblewrap process during its sandbox setup phase. This allows the attacker to control privileged operations within the sandbox setup, particularly the "overlay mount" operation, which normally should not be allowed in setuid mode. This enables the creation of overlay mounts that bypass the intended security restrictions.
The vulnerability was introduced in version 0.11.0 with the addition of overlayfs mount support and affects only setuid installations. It has been patched in version 0.11.2 by preventing ptrace attachment to the low-privileged parts of the setup in setuid mode.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in bubblewrap allows privilege escalation via ptrace in setuid mode, which could potentially lead to unauthorized access or control over system operations. Such unauthorized privilege escalation and control could impact the security and integrity of systems handling sensitive data.
While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, vulnerabilities that allow privilege escalation and unauthorized access generally pose risks to compliance by potentially exposing sensitive personal or health data.
Mitigating this vulnerability by updating to bubblewrap version 0.11.2 or disabling setuid mode helps reduce the risk of unauthorized access, thereby supporting compliance efforts with security requirements in common regulations.
How can this vulnerability impact me? :
This vulnerability allows an attacker to escalate privileges by exploiting the ptrace system call to control privileged operations during the sandbox setup phase in bubblewrap setuid mode. Specifically, the attacker can perform overlay mount operations that should be restricted, potentially leading to unauthorized access or modification of the filesystem.
If you are using bubblewrap in setuid mode versions 0.11.0 to before 0.11.2, your system could be at risk of privilege escalation attacks, which can compromise the security of sandboxed environments and the host system.
Updating to bubblewrap version 0.11.2 or disabling setuid mode mitigates this risk.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability affects bubblewrap installations running in setuid mode between versions 0.11.0 and before 0.11.2. To detect if your system is vulnerable, you should check the installed bubblewrap version and whether it is running with setuid enabled.
- Check the bubblewrap version: `bubblewrap --version`
- Check if the bubblewrap binary has the setuid bit set: `ls -l $(which bubblewrap)` and look for an 's' in the user permission bits (e.g., -rwsr-xr-x)
- If bubblewrap is setuid and version is >= 0.11.0 and < 0.11.2, the system is vulnerable.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should immediately update bubblewrap to version 0.11.2 or later, where the issue has been patched.
Alternatively, disable setuid mode for bubblewrap, as the setuid support is deprecated and disabling it prevents the vulnerability.
Future versions of bubblewrap will remove setuid support entirely, so migrating to non-setuid usage is recommended.