{"id":"CVE-2026-75593","title":"BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner","summary":"BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from …","severity":"high","cvss":7.2,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":["CWE-22"],"vendor":"moby","product":"buildkit","affected":["buildkit < 0.31.2"],"published":"2026-08-19","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:15:59.613","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75593","references":[{"url":"https://github.com/moby/buildkit/releases/tag/v0.31.2","label":"security-advisories@github.com"},{"url":"https://github.com/moby/buildkit/security/advisories/GHSA-g2h8-426c-7976","label":"security-advisories@github.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-75593.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-75593"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519913"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75593"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75593"},{"url":"https://access.redhat.com/errata/RHSA-2026:66521"},{"url":"https://access.redhat.com/errata/RHSA-2026:66022"},{"url":"https://access.redhat.com/errata/RHSA-2026:51065"},{"url":"https://access.redhat.com/errata/RHSA-2026:52807"},{"url":"https://access.redhat.com/errata/RHSA-2026:50953"},{"url":"https://access.redhat.com/errata/RHSA-2026:69255"},{"url":"https://access.redhat.com/errata/RHSA-2026:69917"},{"url":"https://access.redhat.com/errata/RHSA-2026:84734"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-08-25T14:02:16.589697Z"},"cvssSource":"cna","ingestedAt":"2026-09-12T23:00:30.746Z","epss":0.00541,"epssPercentile":0.45292,"patched":["logging_subsystem_for_red_hat_openshift 6.6","openshift_api_for_data_protection 1.5","hardened_images"],"scores":{"cna":7.2,"vendor":6.5},"slug":"CVE-2026-75593","body":"## Overview\n\nBuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access BuildKit control API to issue builds, eg., bypass authentication, etc. This issue is fixed in version 0.31.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:66521** · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.6 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66521)\n- **RHSA-2026:66022** · Red Hat · fixed in: OpenShift API for Data Protection 1.5 · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66022)\n- **RHSA-2026:51065** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51065)\n- **RHSA-2026:52807** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:52807)\n- **RHSA-2026:50953** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:50953)\n- **Red Hat VEX** · Moderate · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Compliance Operator, Kernel Module Management Operator for Red Hat Openshift, Migration Toolkit for Containers, Migration Toolkit for Virtualization, Multicluster Engine for Kubernetes, … · no fix planned: OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat Developer Hub, Red Hat OpenShift Container Platform 4, … · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-75593.json)\n- **RHSA-2026:69255** · Red Hat · fixed in: Red Hat Quay 3.16 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69255)\n- **RHSA-2026:69917** · Red Hat · fixed in: OpenShift Developer Tools and Services 1.6.4 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:69917)\n- **RHSA-2026:84734** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84734)","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":39.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":33568,"id":"CVE-2026-75593","ts":1789010690175,"field":"cvss","old":null,"new":"6.5"},{"seq":33567,"id":"CVE-2026-75593","ts":1789010690175,"field":"severity","old":"none","new":"medium"}]}