Note that this revert leaves Flatpak vulnerable to CVE-2026-87766 (#2166359). I would recommend not running any untrusted Flatpak apps until CVE-2026-87766 in bubblewrap has been resolved.
In other distributions like Debian, Fedora and Mageia, CVE-2026-87766 was addressed by updating bubblewrap to 0.12.0 (even in branches where the distro would normally backport individual security fixes, like Debian 13). The changes made upstream to address CVE-2026-87766 are complicated and unlikely to be feasible to backport successfully into 0.11.x and 0.9.x. Ubuntu universe's version of Flatpak also has other unfixed vulnerabilities in Flatpak itself (see also #2163587), so, again, if using that version of Flatpak, I would recommend not running any untrusted Flatpak apps. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2167621 Title: bubblewrap 0.11.1-1ubuntu0.2 breaks Flatpak applications with bind mount / symlink resolution errors To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/bubblewrap/+bug/2167621/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
