High severity7.5NVD Advisory· Published Jul 21, 2026· Updated Jul 30, 2026
CVE-2026-15789
CVE-2026-15789
Description
A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4cpe:2.3:a:mobyproject:buildkit:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:mobyproject:buildkit:*:*:*:*:*:*:*:*range: <0.31.2
- (no CPE)
- osv-coords2 versions
< 2:1.43.3-2.el9_8+ 1 more
- (no CPE)range: < 2:1.43.3-2.el9_8
- (no CPE)range: < 2:1.43.3-2.el9_8
Patches
Vulnerability mechanics
References
1- github.com/moby/buildkit/security/advisories/GHSA-g2h8-426c-7976nvdVendor Advisory
News mentions
0No linked articles in our index yet.