547 matches found
CVE-2026-15792
A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic...
CVE-2026-15789 Malicious client can bypass destination directory validation on local sources upload
A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...
CVE-2026-15791 LLB file operation can be tricked to remove /tmp directory contents
A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory...
CVE-2026-15791
CVE-2026-15791 concerns BuildKit LLB/file operations where a crafted low-level build API message can escape the build root and remove contents of the host’s /tmp directory. Technical details across sources describe a Directory Traversal in the file operation (FileActionRm.Path) that can lead to h...
EUVD-2026-46309
A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...
CVE-2026-15791
A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory...
CVE-2026-15789 Malicious client can bypass destination directory validation on local sources upload
A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...
CVE-2026-15791 LLB file operation can be tricked to remove /tmp directory contents
A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory...
CVE-2026-15789
A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...
CVE-2026-15789 Malicious client can bypass destination directory validation on local sources upload
A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...
CVE-2026-15791 LLB file operation can be tricked to remove /tmp directory contents
A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory...
CVE-2026-15789
CVE-2026-15789 affects the BuildKit daemon: a custom client with valid BuildKit API access can craft upload requests that bypass destination directory validation, allowing files to escape the BuildKit-controlled state directory. This is a local-privilege issue that requires access to the BuildKit...
EUVD-2026-46310
A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory...
PT-2026-61985
Name of the Vulnerable Software and Affected Versions BuildKit affected versions not specified Description A malicious BuildKit client or frontend can craft a request that causes the BuildKit daemon to crash with a panic, which is a critical error that immediately stops the execution of a program...
PT-2026-61983
Name of the Vulnerable Software and Affected Versions BuildKit affected versions not specified Description A custom client with valid permissions to access the BuildKit control API can send a specially crafted upload request to the BuildKit daemon. This allows files to escape from the...
CVE-2026-15789: Improper Limitation of a Pathname to a Restricted Directory
A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...
CVE-2026-15793: Improper Neutralization of Argument Delimiters in a Command
BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host...
PT-2026-61984
Name of the Vulnerable Software and Affected Versions BuildKit affected versions not specified Description A crafted message in the low-level build API allows an attacker to remove the contents of the /tmp directory. This occurs because an action intended to delete files within the build containe...
CVE-2026-15791: Improper Limitation of a Pathname to a Restricted Directory
A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory...