CVE-2026-75593

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-75593

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-75593.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2026-75593

Aliases

CVE-2026-15789
GHSA-g2h8-426c-7976

Downstream

AZL (1)

AZL-97035

RHSA (3)

Published

2026-08-19T20:06:54Z

Modified

2026-10-22T10:30:51Z

Severity

7.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

BuildKit: Malicious client can bypass destination directory validation on local sources upload

Details

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access BuildKit control API to issue builds, eg., bypass authentication, etc. This issue is fixed in version 0.31.2.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75593.json"
}

References

Affected packages

Git / github.com/moby/buildkit

Affected ranges

Type

GIT

Repo

https://github.com/moby/buildkit

Events

Introduced

Fixed

e42e1bfd389af7203238cce77b1f7dad447285e9

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "0.31.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "original_tag": "v0.31.2",
            "range": [
                {
                    "fixed": "e42e1bfd389af7203238cce77b1f7dad447285e9"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "0.31.2"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

Affected versions

dockerfile/0.*

dockerfile/0.9.0

dockerfile/0.9.0-experimental

dockerfile/1.*

dockerfile/1.0.0

dockerfile/1.0.0-experimental

dockerfile/1.0.1

dockerfile/1.0.1-experimental

dockerfile/1.0.2-experimental

dockerfile/1.1.0

dockerfile/1.1.0-experimental

dockerfile/1.1.1

dockerfile/1.1.1-experimental

dockerfile/1.1.2

dockerfile/1.1.2-experimental

dockerfile/1.1.3

dockerfile/1.1.3-experimental

dockerfile/1.1.6

dockerfile/1.1.6-experimental

dockerfile/1.1.6-rc1

dockerfile/1.1.6-rc1-experimental

dockerfile/1.10.0-rc1

dockerfile/1.10.0-rc1-labs

dockerfile/1.11.0

dockerfile/1.11.0-labs

dockerfile/1.11.0-rc1

dockerfile/1.11.0-rc1-labs

dockerfile/1.11.0-rc2

dockerfile/1.11.0-rc2-labs

dockerfile/1.12.0

dockerfile/1.12.0-labs

dockerfile/1.12.0-rc1

dockerfile/1.12.0-rc1-labs

dockerfile/1.13.0-rc1

dockerfile/1.13.0-rc1-labs

dockerfile/1.14.0-rc1

dockerfile/1.14.0-rc1-labs

dockerfile/1.14.0-rc2

dockerfile/1.14.0-rc2-labs

dockerfile/1.15.0-rc1

dockerfile/1.15.0-rc1-labs

dockerfile/1.16.0-rc1

dockerfile/1.16.0-rc1-labs

dockerfile/1.17.0-rc1

dockerfile/1.17.0-rc1-labs

dockerfile/1.18.0-rc1

dockerfile/1.18.0-rc1-labs

dockerfile/1.18.0-rc2

dockerfile/1.18.0-rc2-labs

dockerfile/1.19.0-rc1

dockerfile/1.19.0-rc1-labs

dockerfile/1.2.0

dockerfile/1.2.0-labs

dockerfile/1.2.0-rc1

dockerfile/1.2.0-rc1-labs

dockerfile/1.2.1

dockerfile/1.2.1-labs

dockerfile/1.20.0

dockerfile/1.20.0-labs

dockerfile/1.20.0-rc1

dockerfile/1.20.0-rc1-labs

dockerfile/1.21.0-rc1

dockerfile/1.21.0-rc1-labs

dockerfile/1.22.0-rc1

dockerfile/1.22.0-rc1-labs

dockerfile/1.22.0-rc2

dockerfile/1.22.0-rc2-labs

dockerfile/1.23.0

dockerfile/1.23.0-labs

dockerfile/1.23.0-rc1

dockerfile/1.23.0-rc1-labs

dockerfile/1.24.0-rc1

dockerfile/1.24.0-rc1-labs

dockerfile/1.25.0

dockerfile/1.25.0-labs

dockerfile/1.25.0-rc1

dockerfile/1.25.0-rc1-labs

dockerfile/1.25.0-rc2

dockerfile/1.25.0-rc2-labs

dockerfile/1.3.0

dockerfile/1.3.0-labs

dockerfile/1.3.0-rc1

dockerfile/1.3.0-rc1-labs

dockerfile/1.4.0

dockerfile/1.4.0-labs

dockerfile/1.4.0-labs-rc1

dockerfile/1.4.0-labs-rc2

dockerfile/1.4.0-rc1

dockerfile/1.4.0-rc2

dockerfile/1.5.0-rc1

dockerfile/1.5.0-rc1-labs

dockerfile/1.5.0-rc2

dockerfile/1.5.0-rc2-labs

dockerfile/1.6.0

dockerfile/1.6.0-labs

dockerfile/1.6.0-rc1

dockerfile/1.6.0-rc1-labs

dockerfile/1.6.0-rc2

dockerfile/1.6.0-rc2-labs

dockerfile/1.7.0-rc1

dockerfile/1.7.0-rc1-labs

dockerfile/1.8.0

dockerfile/1.8.0-labs

dockerfile/1.8.0-rc1

dockerfile/1.8.0-rc1-labs

dockerfile/1.8.0-rc2

dockerfile/1.8.0-rc2-labs

dockerfile/1.9.0

dockerfile/1.9.0-labs

dockerfile/1.9.0-rc1

dockerfile/1.9.0-rc1-labs

dockerfile/1.9.0-rc2

dockerfile/1.9.0-rc2-labs

v0.*

v0.10.0

v0.10.0-rc1

v0.10.0-rc2

v0.11.0-rc1

v0.11.0-rc2

v0.11.0-rc3

v0.12.0

v0.12.0-rc1

v0.12.0-rc2

v0.13.0-beta1

v0.13.0-beta2

v0.13.0-beta3

v0.13.0-rc1

v0.13.0-rc2

v0.13.0-rc3

v0.14.0

v0.14.0-rc1

v0.14.0-rc2

v0.15.0

v0.15.0-rc1

v0.15.0-rc2

v0.16.0-rc1

v0.16.0-rc2

v0.17.0

v0.17.0-rc1

v0.17.0-rc2

v0.18.0

v0.18.0-rc1

v0.18.0-rc2

v0.19.0-rc1

v0.19.0-rc2

v0.19.0-rc3

v0.20.0-rc1

v0.20.0-rc2

v0.21.0-rc1

v0.22.0-rc1

v0.23.0-rc1

v0.24.0-rc1

v0.24.0-rc2

v0.25.0-rc1

v0.26.0

v0.26.0-rc1

v0.26.0-rc2

v0.27.0-rc1

v0.27.0-rc2

v0.28.0-rc1

v0.28.0-rc2

v0.29.0

v0.29.0-rc1

v0.3.0

v0.3.1

v0.3.2

v0.3.3

v0.30.0-rc1

v0.30.0-rc2

v0.31.0

v0.31.0-rc1

v0.31.0-rc2

v0.31.1

v0.4.0

v0.5.0

v0.5.1

v0.6.0

v0.6.1

v0.7.0

v0.7.0-rc1

v0.8.0

v0.8.0-rc1

v0.8.0-rc2

v0.8.0-rc3

v0.8.1

v0.9.0

v0.9.0-rc1

v0.9.0-rc2

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-75593.json"