CVE-2026-15789

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access BuildKit control API to issue builds, eg., bypass authentication, etc. This issue is fixed in version 0.31.2.

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files without an upper bound while resolving a username to a user identifier or group identifier in executor/oci/user.go and solver/llbsolver/ops/user_linux.go. A malicious base image or build could provide oversized files that exhausted memory during user resolution and caused out-of-memory termination of the buildkitd process. This issue is fixed in version 0.31.1.

BuildKit, a toolkit for building artifacts, prior to version 0.31.1 has a vulnerability where a custom frontend can place an invalid SecurityMode value in a crafted build request. The executor treats this value as a non-sandbox mode without requiring the security.insecure entitlement, disabling Seccomp and AppArmor protections for the build container while Linux capabilities remain restricted.

Vulnerability in BuildKit allows a malicious Git source, when git.checkoutbundle=true is set, to execute a crafted command on the host during checkout.

A malicious BuildKit client or frontend can craft a request that causes the BuildKit daemon to crash with a panic.

In BuildKit, a crafted message in the low-level build API can be used to remove the contents of the /tmp directory. The action normally used to delete files inside the build container rootfs can escape into the real host temp directory.

BuildKit on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root. An untrusted user building an image on a WCOW-configured BuildKit daemon can read arbitrary host files reachable to the daemon process.