{"id":"CVE-2026-75593","title":"BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner","summary":"BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from …","severity":"high","cvss":7.2,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":["CWE-22"],"vendor":"moby","product":"buildkit","affected":["buildkit < 0.31.2"],"published":"2026-08-19","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:15:59.613","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75593","references":[{"url":"https://github.com/moby/buildkit/releases/tag/v0.31.2","label":"security-advisories@github.com"},{"url":"https://github.com/moby/buildkit/security/advisories/GHSA-g2h8-426c-7976","label":"security-advisories@github.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-75593.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-75593"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519913"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75593"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75593"},{"url":"https://access.redhat.com/errata/RHSA-2026:66521"},{"url":"https://access.redhat.com/errata/RHSA-2026:66022"},{"url":"https://access.redhat.com/errata/RHSA-2026:51065"},{"url":"https://access.redhat.com/errata/RHSA-2026:52807"},{"url":"https://access.redhat.com/errata/RHSA-2026:50953"},{"url":"https://access.redhat.com/errata/RHSA-2026:69255"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-08-25T14:02:16.589697Z"},"cvssSource":"cna","ingestedAt":"2026-09-12T23:00:30.746Z","epss":0.0054,"epssPercentile":0.4415,"patched":["logging_subsystem_for_red_hat_openshift 6.6","openshift_api_for_data_protection 1.5","hardened_images"],"scores":{"cna":7.2,"vendor":6.5},"slug":"CVE-2026-75593","body":"## Overview\n\nBuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access BuildKit control API to issue builds, eg., bypass authentication, etc. This issue is fixed in version 0.31.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:66521** · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.6 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66521)\n- **RHSA-2026:66022** · Red Hat · fixed in: OpenShift API for Data Protection 1.5 · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66022)\n- **RHSA-2026:51065** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51065)\n- **RHSA-2026:52807** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:52807)\n- **RHSA-2026:50953** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:50953)\n- **Red Hat VEX** · Moderate · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Compliance Operator, Confidential Compute Attestation, Kernel Module Management Operator for Red Hat Openshift, Logical Volume Manager Storage, Migration Toolkit for Applications 8, … · no fix planned: OpenShift Lightspeed, Red Hat Developer Hub, Migration Toolkit for Virtualization, OpenShift Developer Tools and Services, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-75593.json)\n- **RHSA-2026:69255** · Red Hat · fixed in: Red Hat Quay 3.16 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69255)","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":39.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":33568,"id":"CVE-2026-75593","ts":1789010690175,"field":"cvss","old":null,"new":"6.5"},{"seq":33567,"id":"CVE-2026-75593","ts":1789010690175,"field":"severity","old":"none","new":"medium"}]}