CVE-2026-75593
BuildKit: Malicious client can bypass destination directory validation on local sources upload
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access BuildKit control API to issue builds, eg., bypass authentication, etc. This issue is fixed in version 0.31.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
BuildKit: Malicious client can bypass destination directory validation on local sources upload
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access BuildKit control API to issue builds, eg., bypass authentication, etc. This issue is fixed in version 0.31.2.
- Record
CVE-2026-75593- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2026-62839
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access BuildKit control API to issue builds, eg., bypass authentication, etc. This issue is fixed in version 0.31.2.
- Record
EUVD-2026-62839- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wqjv-cjqw-p7p5
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive...
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access BuildKit control API to issue builds, eg., bypass authentication, etc. This issue is fixed in version 0.31.2.
- Record
GHSA-wqjv-cjqw-p7p5- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access BuildKit control API to issue builds, eg., bypass authentication, etc. This issue is fixed in version 0.31.2.
- Record
CVE-2026-75593- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVCVE-2026-15789
Malicious client can bypass destination directory validation on local sources upload
A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc.
- Record
CVE-2026-15789- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
BuildKit: Malicious client can bypass destination directory validation on local sources upload
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access BuildKit control API to issue builds, eg., bypass authentication, etc. This issue is fixed in version 0.31.2.
- Record
CVE-2026-75593- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-22
- Updated
- 2026-11-02
Show 4 moreShow less
OSVRHSA-2026:50953
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:50953- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L - Updated
- 2026-11-02
OSVRHSA-2026:51065
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:51065- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:52807
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:52807- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-97035 No score
CVE-2026-75593 affecting package moby-engine for versions less than 25.0.3-20
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access BuildKit control API to issue builds, eg., bypass authentication, etc. This issue is fixed in version 0.31.2.
- Record
AZL-97035- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moby-engineAzure Linux:3 |
before 25.0.3-20 | 25.0.3-20 |
trivyRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:0.73.0-0.1.hum1 | 0:0.73.0-0.1.hum1 |
buildahRed Hat:hummingbird:1 From an advisory covering 4 CVEs |
before 0:1.45.0-2.hum1 | 0:1.45.0-2.hum1 |
podmanRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:6.0.2-2.2.hum1 | 0:6.0.2-2.2.hum1 |
podman-dockerRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:6.0.2-2.2.hum1 | 0:6.0.2-2.2.hum1 |
podman-machineRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:6.0.2-2.2.hum1 | 0:6.0.2-2.2.hum1 |
podman-remoteRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:6.0.2-2.2.hum1 | 0:6.0.2-2.2.hum1 |
podmanshRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:6.0.2-2.2.hum1 | 0:6.0.2-2.2.hum1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-75593 is a high vulnerability (CVSS 7.2) in Moby Buildkit, published July 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. Fixed in moby-engine 25.0.3-20.
References
github.com/moby/buildkit/security/advisories/GHSA-g2h8-426c-7976
nvd.nist.gov/vuln/detail/CVE-2026-75593
Show 47 moreShow less
access.redhat.com/errata/RHSA-2026:50953
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50953.json
bugzilla.redhat.com/show_bug.cgi?id=2512562
cve.org/CVERecord?id=CVE-2026-71556
go.dev/cl/794100
pkg.go.dev/vuln/GO-2026-5970
docs.docker.com/desktop/release-notes