CVE-2026-15789 Malicious client can bypass destination directory validation on local sources upload
A malicious client with API access can bypass directory validation to read or modify files outside the BuildKit state directory.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-15789?
CVE-2026-15789 is a medium-severity path traversal vulnerability in moby BuildKit, published on 21 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc.
Weakness: CWE-22
Which versions are affected by CVE-2026-15789?
It affects 1 product.
Linux distribution packages (5)
podman Red Hat:hummingbird:1 | All versions | 0:6.0.2-2.3.hum1 |
podman-docker Red Hat:hummingbird:1 | All versions | 0:6.0.2-2.3.hum1 |
podman-machine Red Hat:hummingbird:1 | All versions | 0:6.0.2-2.3.hum1 |
podman-remote Red Hat:hummingbird:1 | All versions | 0:6.0.2-2.3.hum1 |
podmansh Red Hat:hummingbird:1 | All versions | 0:6.0.2-2.3.hum1 |
Products include Mobyproject Buildkit.
How do I fix CVE-2026-15789?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-15789 being exploited?
There is no known exploitation of CVE-2026-15789 in the wild and no public exploit code.
Other vulnerabilities in moby BuildKit
- CVE-2024-23652 BuildKit possible host system access from mount stub cleaner
- CVE-2024-23653 BuildKit interactive containers API does not validate entitlements check
- CVE-2024-23651 BuildKit possible race condition with accessing subpaths from cache mounts
- CVE-2026-33747 BuildKit vulnerable to malicious frontend causing file escape outside of storage root
- CVE-2026-33748 BuildKit Git URL subdir component can cause access to restricted files
Sources
Also known as RHSA-2026:62771.