CVE-2026-15789

Name
CVE-2026-15789
Description
A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Vendor Advisory https://github.com/moby/buildkit/security/advisories/GHSA-g2h8-426c-7976

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:mobyproject:buildkit:*:*:*:*:*:*:*:* buildkit >= None < 0.31.2

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
buildkit edge-community 0.29.0-r2 Hoang Nguyen <folliekazetani@protonmail.com> possibly vulnerable
buildkit edge-community 0.29.0-r1 Hoang Nguyen <folliekazetani@protonmail.com> possibly vulnerable
buildkit edge-community 0.29.0-r0 Hoang Nguyen <folliekazetani@protonmail.com> possibly vulnerable
buildkit edge-community 0.27.0-r3 Hoang Nguyen <folliekazetani@protonmail.com> possibly vulnerable
buildkit edge-community 0.27.0-r2 Hoang Nguyen <folliekazetani@protonmail.com> possibly vulnerable
buildkit edge-community 0.27.0-r1 Hoang Nguyen <folliekazetani@protonmail.com> possibly vulnerable
buildkit edge-community 0.27.0-r0 Hoang Nguyen <folliekazetani@protonmail.com> possibly vulnerable
buildkit edge-community 0.25.1-r2 Hoang Nguyen <folliekazetani@protonmail.com> possibly vulnerable
buildkit edge-community 0.25.1-r1 Hoang Nguyen <folliekazetani@protonmail.com> possibly vulnerable
buildkit edge-community 0.25.1-r0 Hoang Nguyen <folliekazetani@protonmail.com> possibly vulnerable
buildkit edge-community 0.24.0-r1 Hoang Nguyen <folliekazetani@protonmail.com> possibly vulnerable
buildkit edge-community 0.24.0-r0 Hoang Nguyen <folliekazetani@protonmail.com> possibly vulnerable
buildkit edge-community 0.23.2-r3 Hoang Nguyen <folliekazetani@protonmail.com> possibly vulnerable
buildkit edge-community 0.23.2-r2 Hoang Nguyen <folliekazetani@protonmail.com> possibly vulnerable
buildkit edge-community 0.23.2-r1 Hoang Nguyen <folliekazetani@protonmail.com> possibly vulnerable
buildkit edge-community 0.23.2-r0 Hoang Nguyen <folliekazetani@protonmail.com> possibly vulnerable
buildkit edge-community 0.21.1-r0 Hoang Nguyen <folliekazetani@protonmail.com> possibly vulnerable
buildkit edge-community 0.20.1-r2 Hoang Nguyen <folliekazetani@protonmail.com> possibly vulnerable
buildkit edge-community 0.20.1-r1 Hoang Nguyen <folliekazetani@protonmail.com> possibly vulnerable
buildkit edge-community 0.20.1-r0 Hoang Nguyen <folliekazetani@protonmail.com> possibly vulnerable
buildkit edge-community 0.19.0-r2 Hoang Nguyen <folliekazetani@protonmail.com> possibly vulnerable
buildkit edge-community 0.19.0-r1 Hoang Nguyen <folliekazetani@protonmail.com> possibly vulnerable
buildkit edge-community 0.19.0-r0 Hoang Nguyen <folliekazetani@protonmail.com> possibly vulnerable
buildkit edge-community 0.18.2-r1 Hoang Nguyen <folliekazetani@protonmail.com> possibly vulnerable
buildkit edge-community 0.18.2-r0 Hoang Nguyen <folliekazetani@protonmail.com> possibly vulnerable
buildkit edge-community 0.18.1-r0 Hoang Nguyen <folliekazetani@protonmail.com> possibly vulnerable
buildkit edge-community 0.18.0-r0 Hoang Nguyen <folliekazetani@protonmail.com> possibly vulnerable
buildkit edge-community 0.12.5-r0 Hoang Nguyen <folliekazetani@protonmail.com> possibly vulnerable
buildkit 3.24-community 0.29.0-r1 Hoang Nguyen <folliekazetani@protonmail.com> possibly vulnerable