CVE-2026-15789

EUVD-2026-46309
A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 22.73%
Affected Products (NVD)
VendorProductVersion
mobyprojectbuildkit
𝑥
< 0.31.2
𝑥
= Vulnerable software versions
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
buildah
RHEL 9
2:1.43.3-2.el9_8
fixed
buildah-tests
RHEL 9
2:1.43.3-2.el9_8
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
runfinch-finch
Amazon Linux 2023
0:1.19.0-1.amzn2023.0.1
fixed
Common Weakness Enumeration
References
https://github.com/moby/buildkit/security/advisories/GHSA-g2h8-426c-7976