containers bubblewrap vulnerabilities

Latest containers bubblewrap CVEs

Newest publication first

1. CVE-2026-41163 bubblewrap vulnerable to privilege escalation in setuid mode via ptrace

   Published 2026-05-09

   High·CVSS 8.7 EPSS 0.27%

   bubblewrap is a low-level unprivileged sandboxing tool. From version 0.11.0 to before version 0.11.2, if bubblewrap is installed in setuid mode then the user can use ptrace to attach to bubblewrap and control the unprivileged part of the sandbox setup phase. This allows the attac...

2. CVE-2020-5291 Privilege escalation in setuid mode via user namespaces in Bubblewrap

   Published 2020-03-31

   High·CVSS 7.8 EPSS 0.90%

   Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the bwrap --userns2 option can be used to make the setuid process keep running as root while being traceable. This can in turn be used to gain root perm...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.