CVE-2026-15791 LLB file operation can be tricked to remove /tmp directory contents
Attackers can use crafted BuildKit API messages to delete host /tmp contents via path traversal, impacting container infrastructure security.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-15791?
CVE-2026-15791 is a low-severity path traversal vulnerability in moby BuildKit, published on 21 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory.
Weakness: CWE-22
Which versions are affected by CVE-2026-15791?
It affects 1 product.
Products include Mobyproject Buildkit.
How do I fix CVE-2026-15791?
No fix has been published for CVE-2026-15791 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-15791 being exploited?
There is no known exploitation of CVE-2026-15791 in the wild and no public exploit code.
Other vulnerabilities in moby BuildKit
- CVE-2024-23652 BuildKit possible host system access from mount stub cleaner
- CVE-2024-23653 BuildKit interactive containers API does not validate entitlements check
- CVE-2024-23651 BuildKit possible race condition with accessing subpaths from cache mounts
- CVE-2026-33747 BuildKit vulnerable to malicious frontend causing file escape outside of storage root
- CVE-2026-33748 BuildKit Git URL subdir component can cause access to restricted files
Sources
Also known as GHSA-32pv-7hq5-qhwq, UBUNTU-CVE-2026-15791.