CVE-2026-15792

CVE-2026-15792 affects BuildKit components (notably the LLB solver/llbsolver) where a malicious BuildKit frontend or LLB input can trigger NULL pointer dereference or slice-index panics, crashing the BuildKit daemon. Public detail across sources indicates vulnerable paths in the solver handling a...

CVE-2026-15793 Git source checkout from a bundle file could lead to command injection

BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host...

EUVD-2026-46312

BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host...

CVE-2026-15793 Git source checkout from a bundle file could lead to command injection

BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host...

EUVD-2026-46311

A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic...

CVE-2026-15792 Possible panic when incorrect parameters sent from frontend

A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic...

CVE-2026-15793

CVE-2026-15793 affects BuildKit-based workflows using the raw low‑level API. When a Git source is checked out with git.checkoutbundle=true, and the source is malicious, this can trigger a crafted command invocation on the host. Affected component: BuildKit custom frontends/clients (low‑level API ...

CVE-2026-15793 Git source checkout from a bundle file could lead to command injection

BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host...

CVE-2026-15792 Possible panic when incorrect parameters sent from frontend

A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic...

CVE-2026-15792 Possible panic when incorrect parameters sent from frontend

A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic...

CVE-2026-15792

A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic...

EUVD-2026-46309

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...

CVE-2026-15791 LLB file operation can be tricked to remove /tmp directory contents

A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory...

CVE-2026-15789 Malicious client can bypass destination directory validation on local sources upload

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...

CVE-2026-15791

CVE-2026-15791 concerns BuildKit LLB/file operations where a crafted low-level build API message can escape the build root and remove contents of the host’s /tmp directory. Technical details across sources describe a Directory Traversal in the file operation (FileActionRm.Path) that can lead to h...

CVE-2026-15791

A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory...

CVE-2026-15789 Malicious client can bypass destination directory validation on local sources upload

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...

CVE-2026-15791 LLB file operation can be tricked to remove /tmp directory contents

A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory...

CVE-2026-15789

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...

CVE-2026-15789 Malicious client can bypass destination directory validation on local sources upload

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...