Every CVE Search/ Get API key

CVE-2026-15789

Malicious client can bypass destination directory validation on local sources upload

6.9 MediumFix available

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
High

Exploit likelihood

0.31%Up 0.2 points since Jul 22, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.9

Malicious client can bypass destination directory validation on local sources upload

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc.

Record
CVE-2026-15789
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2026-46309 6.9

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc.

Record
EUVD-2026-46309
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
NVD 6.9

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc.

Record
CVE-2026-15789
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
OSV 6.9

Malicious client can bypass destination directory validation on local sources upload

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc.

Record
CVE-2026-15789
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-22
Updated
2026-11-02
OSVCVE-2026-75593 7.2

BuildKit: Malicious client can bypass destination directory validation on local sources upload

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access BuildKit control API to issue builds, eg., bypass authentication, etc. This issue is fixed in version 0.31.2.

Record
CVE-2026-75593
CVSS 4.0
7.2 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-22
Updated
2026-11-02
OSVRHSA-2026:51065 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:51065
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVRHSA-2026:62771 6.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:62771
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:66421 7.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:66421
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Updated
2026-11-02
OSVRHSA-2026:70640 8.1

Red Hat Security Advisory: buildah security update

Record
RHSA-2026:70640
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:70640 8.1

Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

  • buildah: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

  • buildah: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

  • buildah: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)

  • buildah: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)

  • buildah: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:70640
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVALSA-2026:70640 No score

Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

  • buildah: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
  • buildah: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
  • buildah: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
  • buildah: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
  • buildah: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:70640
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
buildah
AlmaLinux:9
From an advisory covering 8 CVEs
 before 2:1.43.3-2.el9_8
2:1.43.3-2.el9_8
buildah-tests
AlmaLinux:9
From an advisory covering 8 CVEs
 before 2:1.43.3-2.el9_8
2:1.43.3-2.el9_8
buildah
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:1.45.0-2.hum1
0:1.45.0-2.hum1
podman
Red Hat:hummingbird:1
 before 0:6.0.2-2.3.hum1
0:6.0.2-2.3.hum1
podman-docker
Red Hat:hummingbird:1
 before 0:6.0.2-2.3.hum1
0:6.0.2-2.3.hum1
podman-machine
Red Hat:hummingbird:1
 before 0:6.0.2-2.3.hum1
0:6.0.2-2.3.hum1
podman-remote
Red Hat:hummingbird:1
 before 0:6.0.2-2.3.hum1
0:6.0.2-2.3.hum1
podmansh
Red Hat:hummingbird:1
 before 0:6.0.2-2.3.hum1
0:6.0.2-2.3.hum1
trivy
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:0.74.0-0.2.hum1
0:0.74.0-0.2.hum1
buildah
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 2:1.43.3-2.el9_8
2:1.43.3-2.el9_8
Show 5 moreShow less
Affected packages
PackageAffectedFixed
buildah-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 2:1.43.3-2.el9_8
2:1.43.3-2.el9_8
buildah-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 2:1.43.3-2.el9_8
2:1.43.3-2.el9_8
buildah-tests
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 2:1.43.3-2.el9_8
2:1.43.3-2.el9_8
buildah-tests-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 2:1.43.3-2.el9_8
2:1.43.3-2.el9_8
buildah
Rocky Linux:9
From an advisory covering 8 CVEs
 before 2:1.43.3-2.el9_8
2:1.43.3-2.el9_8

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-15789 is a medium vulnerability (CVSS 6.9) in Moby Buildkit, published July 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in podman 0:6.0.2-2.3.hum1.

References

Show 92 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open