---
id: CVE-2026-75593
title: >-
  BuildKit is a toolkit for converting source code to build artifacts in an
  efficient, expressive and repeatable manner
summary: >-
  BuildKit is a toolkit for converting source code to build artifacts in an
  efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client
  can produce such an upload request to the BuildKit daemon that files can
  escape from …
severity: high
cvss: 7.2
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-22
vendor: moby
product: buildkit
affected:
  - buildkit < 0.31.2
published: '2026-08-19'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:15:59.613'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75593'
references:
  - url: 'https://github.com/moby/buildkit/releases/tag/v0.31.2'
    label: security-advisories@github.com
  - url: 'https://github.com/moby/buildkit/security/advisories/GHSA-g2h8-426c-7976'
    label: security-advisories@github.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-75593.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-75593'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2519913'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-75593'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75593'
  - url: 'https://access.redhat.com/errata/RHSA-2026:66521'
  - url: 'https://access.redhat.com/errata/RHSA-2026:66022'
  - url: 'https://access.redhat.com/errata/RHSA-2026:51065'
  - url: 'https://access.redhat.com/errata/RHSA-2026:52807'
  - url: 'https://access.redhat.com/errata/RHSA-2026:50953'
  - url: 'https://access.redhat.com/errata/RHSA-2026:69255'
  - url: 'https://access.redhat.com/errata/RHSA-2026:69917'
  - url: 'https://access.redhat.com/errata/RHSA-2026:84734'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-08-25T14:02:16.589697Z'
cvssSource: cna
ingestedAt: '2026-09-12T23:00:30.746Z'
epss: 0.00541
epssPercentile: 0.45292
patched:
  - logging_subsystem_for_red_hat_openshift 6.6
  - openshift_api_for_data_protection 1.5
  - hardened_images
scores:
  cna: 7.2
  vendor: 6.5
---

## Overview

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access BuildKit control API to issue builds, eg., bypass authentication, etc. This issue is fixed in version 0.31.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:66521** · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.6 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66521)
- **RHSA-2026:66022** · Red Hat · fixed in: OpenShift API for Data Protection 1.5 · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66022)
- **RHSA-2026:51065** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51065)
- **RHSA-2026:52807** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:52807)
- **RHSA-2026:50953** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:50953)
- **Red Hat VEX** · Moderate · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Compliance Operator, Kernel Module Management Operator for Red Hat Openshift, Migration Toolkit for Containers, Migration Toolkit for Virtualization, Multicluster Engine for Kubernetes, … · no fix planned: OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat Developer Hub, Red Hat OpenShift Container Platform 4, … · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-75593.json)
- **RHSA-2026:69255** · Red Hat · fixed in: Red Hat Quay 3.16 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69255)
- **RHSA-2026:69917** · Red Hat · fixed in: OpenShift Developer Tools and Services 1.6.4 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:69917)
- **RHSA-2026:84734** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84734)