bubblewrap is a low-level unprivileged sandboxing tool. From version 0.11.0 to before version 0.11.2, if bubblewrap is installed in setuid mode then the user can use ptrace to attach to bubblewrap and control the unprivileged part of the sandbox setup phase. This allows the attacker to arbitrarily use the privileged operations, and in particular the "overlay mount" operation, allowing the creation of overlay mounts which is otherwise not allowed in the setuid version of bubblewrap. This issue has been patched in version 0.11.2.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20811-1 advisory.

    This update for bubblewrap fixes the following issue

    - CVE-2026-41163: improper process attachment via ptrace can lead to arbitrary privileged operations and     local root       escalation (bsc#1263113).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2094-1 advisory.

    This update for bubblewrap fixes the following issue

    - CVE-2026-41163: improper process attachment via ptrace can lead to arbitrary privileged operations and     local root       escalation (bsc#1263113).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 25.10 / 26.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8288-1 advisory.

    It was discovered that Bubblewrap incorrectly handled the sandbox setup phase when installed in setuid     mode. A local attacker could possibly use this issue to bypass sandbox restrictions.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
317700	openSUSE 16 Security Update : bubblewrap (openSUSE-SU-2026:20811-1)	Nessus	SuSE Local Security Checks	high
317665	SUSE SLED15 / SLES15 Security Update : bubblewrap (SUSE-SU-2026:2094-1)	Nessus	SuSE Local Security Checks	high
316493	Ubuntu 25.10 / 26.04 LTS : Bubblewrap vulnerability (USN-8288-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2026-41163

high

Tenable Plugins

high

high

high