CVE-2024-9675

HighCVSS 7.8

Published: 09/10/2024(UTC)Updated: 07/08/2026(UTC)Translated: 30/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

32th percentile - higher than 32% of all known CVEs

Summary

A vulnerability in Buildah where cache mounts do not properly validate user-specified paths, allowing a `RUN` instruction in a Container file to mount an arbitrary host directory (read/write) into the container if accessible by the Buildah user.

Risk Assessment

An attacker could gain unauthorized access to or modify sensitive host data, compromising system confidentiality and integrity.

Recommendation

Immediately update Buildah to a version that includes the fix for cache mount path validation.

Other vulnerabilities in Buildah

CVE-2026-44517Medium
Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left by a partially extracted tar archive. A malicious server supplying a Git repository or tar archive can cause files outside the build context directory to be included in the context or copied into the build.

Original NVD description (English source)

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.