CVE-2026-15793

Git source checkout from a bundle file could lead to command injection

6.5 Medium

BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Active

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.20%Down 0.2 points since Jul 22, 2026

What each source reports

CVE List Score used 6.5

Git source checkout from a bundle file could lead to command injection

Record: CVE-2026-15793
CVSS 4.0: 6.5 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-88
Updated: 2026-11-02

EUVDEUVD-2026-46312 6.5

Record: EUVD-2026-46312
CVSS 4.0: 6.5 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

NVD 7.3

Record: CVE-2026-15793
CVSS 4.0: 7.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-88
Updated: 2026-11-02

OSVBELL-CVE-2026-15793 7.5

CVE-2026-15793 does not affect BellSoft software

Record: BELL-CVE-2026-15793
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSV 7.3

Git source checkout from a bundle file could lead to command injection

Record: CVE-2026-15793
CVSS 4.0: 7.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-88
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-15793 7.3

Record: UBUNTU-CVE-2026-15793
CVSS 4.0: 7.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`docker.io` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 1.6.2~dfsg1-1ubuntu41.10.2-0ubuntu31.10.2-0ubuntu41.10.3-0ubuntu11.10.3-0ubuntu4 Show 19 moreShow less 1.10.3-0ubuntu51.10.3-0ubuntu61.11.2-0ubuntu5~16.041.12.1-0ubuntu13~16.04.11.12.3-0ubuntu4~16.04.21.12.6-0ubuntu1~16.04.11.13.1-0ubuntu1~16.04.217.03.2-0ubuntu2~16.04.118.06.1-0ubuntu1~16.04.218.06.1-0ubuntu1.2~16.04.118.09.2-0ubuntu1~16.04.118.09.5-0ubuntu1~16.04.218.09.7-0ubuntu1~16.04.118.09.7-0ubuntu1~16.04.418.09.7-0ubuntu1~16.04.518.09.7-0ubuntu1~16.04.618.09.7-0ubuntu1~16.04.718.09.7-0ubuntu1~16.04.9+esm118.09.7-0ubuntu1~16.04.9+esm2	None known
`docker.io` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 1.13.1-0ubuntu617.03.2-0ubuntu117.03.2-0ubuntu317.03.2-0ubuntu517.12.1-0ubuntu1 Show 22 moreShow less 18.06.1-0ubuntu1~18.04.118.06.1-0ubuntu1.2~18.04.118.09.2-0ubuntu1~18.04.118.09.5-0ubuntu1~18.04.218.09.7-0ubuntu1~18.04.118.09.7-0ubuntu1~18.04.318.09.7-0ubuntu1~18.04.419.03.6-0ubuntu1~18.04.119.03.6-0ubuntu1~18.04.219.03.6-0ubuntu1~18.04.320.10.2-0ubuntu1~18.04.220.10.2-0ubuntu1~18.04.320.10.7-0ubuntu1~18.04.120.10.7-0ubuntu1~18.04.220.10.7-0ubuntu5~18.04.220.10.7-0ubuntu5~18.04.320.10.12-0ubuntu2~18.04.120.10.21-0ubuntu1~18.04.220.10.21-0ubuntu1~18.04.320.10.21-0ubuntu1~18.04.3+esm120.10.21-0ubuntu1~18.04.3+esm220.10.21-0ubuntu1~18.04.3+esm3	None known
`docker.io` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 19.03.2-0ubuntu119.03.6-0ubuntu119.03.8-0ubuntu119.03.8-0ubuntu1.20.0419.03.8-0ubuntu1.20.04.1 Show 15 moreShow less 19.03.8-0ubuntu1.20.04.220.10.2-0ubuntu1~20.04.220.10.2-0ubuntu1~20.04.320.10.7-0ubuntu1~20.04.120.10.7-0ubuntu1~20.04.220.10.7-0ubuntu5~20.04.120.10.7-0ubuntu5~20.04.220.10.12-0ubuntu2~20.04.120.10.21-0ubuntu1~20.04.120.10.21-0ubuntu1~20.04.220.10.21-0ubuntu1~20.04.420.10.21-0ubuntu1~20.04.520.10.21-0ubuntu1~20.04.620.10.21-0ubuntu1~20.04.6+esm120.10.21-0ubuntu1~20.04.6+esm2	None known
`docker.io-app` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 20.10.25-0ubuntu1~20.04.120.10.25-0ubuntu1~20.04.224.0.5-0ubuntu1~20.04.124.0.7-0ubuntu2~20.04.126.1.3-0ubuntu1~20.04.126.1.3-0ubuntu1~20.04.1+esm126.1.3-0ubuntu1~20.04.1+esm2	None known
`docker.io` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 20.10.7-0ubuntu520.10.7-0ubuntu720.10.12-0ubuntu120.10.12-0ubuntu220.10.12-0ubuntu3 Show 11 moreShow less 20.10.12-0ubuntu3+gke1.24.120.10.12-0ubuntu420.10.21-0ubuntu1~22.04.220.10.21-0ubuntu1~22.04.320.10.21-0ubuntu1~22.04.520.10.21-0ubuntu1~22.04.620.10.21-0ubuntu1~22.04.720.10.21-0ubuntu1~22.04.7+esm120.10.21-0ubuntu1~22.04.7+esm220.10.21-0ubuntu1~22.04.820.10.21-0ubuntu1~22.04.8+esm1	None known
`docker.io-app` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 20.10.25-0ubuntu1~22.04.120.10.25-0ubuntu1~22.04.224.0.5-0ubuntu1~22.04.124.0.7-0ubuntu2~22.04.126.1.3-0ubuntu1~22.04.1 Show 6 moreShow less 26.1.3-0ubuntu1~22.04.1+esm127.5.1-0ubuntu3~22.04.127.5.1-0ubuntu3~22.04.228.2.2-0ubuntu1~22.04.129.1.3-0ubuntu3~22.04.129.1.3-0ubuntu3~22.04.2	None known
`docker.io` Ubuntu:Pro:24.04:LTS	All versions, plus listed versions 20.10.24+dfsg1-1ubuntu220.10.25+dfsg1-2ubuntu120.10.25+dfsg1-2ubuntu1+esm120.10.25+dfsg1-2ubuntu1+esm220.10.25+dfsg1-2ubuntu1.24.04.120.10.25+dfsg1-2ubuntu1.24.04.1+esm1	None known
`docker.io-app` Ubuntu:Pro:24.04:LTS	All versions, plus listed versions 24.0.5-0ubuntu124.0.7-0ubuntu124.0.7-0ubuntu224.0.7-0ubuntu324.0.7-0ubuntu4 Show 8 moreShow less 24.0.7-0ubuntu4.126.1.3-0ubuntu1~24.04.126.1.3-0ubuntu1~24.04.1+esm127.5.1-0ubuntu3~24.04.127.5.1-0ubuntu3~24.04.228.2.2-0ubuntu1~24.04.129.1.3-0ubuntu3~24.04.129.1.3-0ubuntu3~24.04.2	None known
`docker.io` Ubuntu:26.10	All versions, plus listed versions 27.5.1+dfsg4-2ubuntu128.5.2+dfsg4-5ubuntu1	None known
`docker.io-app` Ubuntu:26.10	All versions, plus listed versions 29.1.3-0ubuntu429.1.3-0ubuntu529.1.3-0ubuntu629.7.2-0ubuntu1	None known
`docker.io` Ubuntu:26.04:LTS	All versions, plus listed versions 26.1.5+dfsg1-9ubuntu127.5.1+dfsg4-1ubuntu127.5.1+dfsg4-2ubuntu1	None known
`docker.io-app` Ubuntu:26.04:LTS	All versions, plus listed versions 28.2.2-0ubuntu129.1.2-0ubuntu129.1.3-0ubuntu129.1.3-0ubuntu229.1.3-0ubuntu329.1.3-0ubuntu429.1.3-0ubuntu4.1	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-15793 is a medium vulnerability (CVSS 6.5) in Moby Buildkit, published July 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 10th percentile. No source names a fixed version.