Oracle bubblewrap Important Sandbox Mount Fix ELSA-2026

Back Linuxsecurity

Oracle bubblewrap Important Sandbox Mount Fix ELSA-2026

Linuxsecurity •LinuxSecurity Advisories • October 21, 2026

Share: View original

Running self-managed GitLab? Critical flaws could allow server code execution. Check the fixes. ×

[0.10.0-5] - Fix CVE-2026-87766: harden sandbox mount paths [0.10.0-4] - Add tmt plans

[0.10.0-5] - Fix CVE-2026-87766: harden sandbox mount paths [0.10.0-4] - Add tmt plans

bubblewrap-0.10.0-5.el10_2.x86_64.rpm

bubblewrap-0.10.0-5.el10_2.x86_64.rpm

bubblewrap-0.10.0-5.el10_2.aarch64.rpm

bubblewrap-0.10.0-5.el10_2.aarch64.rpm

Related CVEs: CVE-2026-87766

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Oracle Bubblewrap Vulnerability Fixes Address Path Traversal Flaw Oracle has released multiple updates for its Bubblewrap tool to address a path traversal vulnerability identified as CVE-2026-87766. This flaw affects self-managed GitLab installations, potentially allowing unauthorized server code execution. The vulnerability was published on September 9, 2026, with a CVSS score of 8.8, categorizing it as high severity. The updates include versions 0.6.3-1.1 for Oracle Linux 9, 0.10.0-5 for Oracle Linux 10, and 0.4.0-3 for Oracle Linux 8. Administrators are urged to apply these patches immediately to mitigate risks. The vulnerability is associated with symlinked mount targets and improper directory traversal during setup, making it for users to update their systems promptly. 3 sources 61

Extracted Entities

CVEs (1)