--- id: CVE-2026-33748 title: >- github.com/moby/buildkit: BuildKit: Unauthorized file access via Git URL fragment subdir components (CVE-2026-33748) summary: >- A flaw was found in BuildKit. Insufficient validation of Git URL fragment subdirectory components may allow a remote attacker to access files outside the checked-out Git repository root. This access is limited to files on the same mounted … severity: medium cvss: 6.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N' cvssSource: vendor cwe: CWE-22 vendor: Red Hat product: Red Hat Openshift Data Foundation 4.22 affected: - assisted_installer_for_red_hat_openshift_container_platform 2 - confidential_compute_attestation - migration_toolkit_for_containers - migration_toolkit_for_virtualization - openshift_serverless - build_of_podman_desktop - build_of_podman_desktop_tech_preview - openshift_ai_rhoai - openshift_container_platform 4 - openshift_gitops - quay 3 - openshift_api_for_data_protection 1.3 - openshift_api_for_data_protection 1.4 - openshift_api_for_data_protection 1.5 - openshift_service_mesh 3.0 - openshift_service_mesh 3.1 - openshift_service_mesh 3.2 - openshift_data_foundation 4.20 - openshift_data_foundation 4.22 - quay 3.14 - trusted_artifact_signer 1.3 - multicluster_engine_for_kubernetes 2.1 - multicluster_engine_for_kubernetes 2.8 patched: - openshift_api_for_data_protection 1.3 - openshift_api_for_data_protection 1.4 - openshift_api_for_data_protection 1.5 - openshift_service_mesh 3.0 - openshift_service_mesh 3.1 - openshift_service_mesh 3.2 - openshift_data_foundation 4.20 - openshift_data_foundation 4.22 - quay 3.14 - trusted_artifact_signer 1.3 - multicluster_engine_for_kubernetes 2.1 - multicluster_engine_for_kubernetes 2.8 published: '2026-03-27' updated: '2026-09-22' sourceUpdated: '2026-09-22T18:07:06+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33748.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33748.json - url: 'https://access.redhat.com/security/cve/CVE-2026-33748' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2452271' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-33748' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-33748' - url: 'https://docs.docker.com/build/concepts/context/#url-fragments' - url: 'https://github.com/moby/buildkit/releases/tag/v0.28.1' - url: 'https://github.com/moby/buildkit/security/advisories/GHSA-4vrq-3vrq-g6gg' - url: 'https://access.redhat.com/errata/RHSA-2026:51033' - url: 'https://access.redhat.com/errata/RHSA-2026:29854' - url: 'https://access.redhat.com/errata/RHSA-2026:26568' - url: 'https://access.redhat.com/errata/RHSA-2026:9440' - url: 'https://access.redhat.com/errata/RHSA-2026:9448' - url: 'https://access.redhat.com/errata/RHSA-2026:9453' - url: 'https://access.redhat.com/errata/RHSA-2026:57013' - url: 'https://access.redhat.com/errata/RHSA-2026:37387' - url: 'https://access.redhat.com/errata/RHSA-2026:70267' - url: 'https://access.redhat.com/errata/RHSA-2026:10125' - url: 'https://access.redhat.com/errata/RHSA-2026:46885' - url: 'https://access.redhat.com/errata/RHSA-2026:30650' - url: 'https://github.com/moby/buildkit' tags: - csaf - vex - red-hat - osv - go epss: 0.00463 epssPercentile: 0.39412 aliases: - GHSA-4vrq-3vrq-g6gg - GO-2026-4859 ecosystem: go scores: vendor: 6.5 osv: 7.5 ingestedAt: '2026-09-12T03:13:01.754Z' --- ## Overview A flaw was found in BuildKit. Insufficient validation of Git URL fragment subdirectory components may allow a remote attacker to access files outside the checked-out Git repository root. This access is limited to files on the same mounted filesystem. This vulnerability could lead to unauthorized information disclosure. ## Vendor advisories - **RHSA-2026:51033** · Red Hat · fixed in: OpenShift API for Data Protection 1.3 · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51033) - **RHSA-2026:29854** · Red Hat · fixed in: OpenShift API for Data Protection 1.4 · released 2026-06-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:29854) - **RHSA-2026:26568** · Red Hat · fixed in: OpenShift API for Data Protection 1.5 · released 2026-06-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:26568) - **RHSA-2026:9440** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.0 · released 2026-04-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:9440) - **RHSA-2026:9448** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.1 · released 2026-04-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:9448) - **RHSA-2026:9453** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.2 · released 2026-04-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:9453) - **RHSA-2026:57013** · Red Hat · fixed in: Red Hat Openshift Data Foundation 4.20 · released 2026-08-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:57013) - **RHSA-2026:37387** · Red Hat · fixed in: Red Hat Openshift Data Foundation 4.22 · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:37387) - **RHSA-2026:70267** · Red Hat · fixed in: Red Hat Quay 3.14 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:70267) - **RHSA-2026:10125** · Red Hat · fixed in: Red Hat Trusted Artifact Signer 1.3 · released 2026-04-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:10125) - **RHSA-2026:46885** · Red Hat · fixed in: multicluster engine for Kubernetes 2.1 · released 2026-07-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:46885) - **Red Hat VEX** · Moderate · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Confidential Compute Attestation, Migration Toolkit for Containers, Migration Toolkit for Virtualization, OpenShift Serverless, Red Hat Build of Podman Desktop, … · no fix planned: Confidential Compute Attestation, Migration Toolkit for Virtualization, OpenShift Serverless, Red Hat Build of Podman Desktop, … · updated 2026-09-22 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33748.json) **github.com/moby/buildkit: BuildKit: Unauthorized file access via Git URL fragment subdir components** — rated Moderate by Red Hat. Released 2026-03-27, updated 2026-09-22. Affected: - Assisted Installer for Red Hat OpenShift Container Platform 2 - Confidential Compute Attestation - Migration Toolkit for Containers - Migration Toolkit for Virtualization - OpenShift Serverless - Red Hat Build of Podman Desktop - Red Hat Build of Podman Desktop - Tech Preview - Red Hat OpenShift AI (RHOAI) - Red Hat OpenShift Container Platform 4 - Red Hat OpenShift GitOps - Red Hat Quay 3 Fixed: - OpenShift API for Data Protection 1.3 - OpenShift API for Data Protection 1.4 - OpenShift API for Data Protection 1.5 - Red Hat OpenShift Service Mesh 3.0 - Red Hat OpenShift Service Mesh 3.1 - Red Hat OpenShift Service Mesh 3.2 - Red Hat Openshift Data Foundation 4.20 - Red Hat Openshift Data Foundation 4.22 - Red Hat Quay 3.14 - Red Hat Trusted Artifact Signer 1.3 - multicluster engine for Kubernetes 2.1 - multicluster engine for Kubernetes 2.8 No fix planned: - Confidential Compute Attestation - Migration Toolkit for Virtualization - OpenShift Serverless - Red Hat Build of Podman Desktop - Red Hat Build of Podman Desktop - Tech Preview - Red Hat OpenShift Container Platform 4 - Assisted Installer for Red Hat OpenShift Container Platform 2 - Migration Toolkit for Containers - Red Hat OpenShift AI (RHOAI) - Red Hat OpenShift GitOps - Red Hat Quay 3 Not affected: - OpenShift API for Data Protection 1.3 - OpenShift API for Data Protection 1.4 - OpenShift API for Data Protection 1.5 - Red Hat OpenShift Service Mesh 3.0 - Red Hat OpenShift Service Mesh 3.1 - Red Hat OpenShift Service Mesh 3.2 - Red Hat Openshift Data Foundation 4.20 - Red Hat Openshift Data Foundation 4.22 - Red Hat Quay 3.14 - Kernel Module Management Operator for Red Hat Openshift ## Remediation Before applying this update, make sure all previously released errata relevant to your system have been applied. https://access.redhat.com/errata/RHSA-2026:51033 Before applying this update, make sure all previously released errata relevant to your system have been applied. https://access.redhat.com/errata/RHSA-2026:29854 Before applying this update, make sure all previously released errata relevant to your system have been applied. https://access.redhat.com/errata/RHSA-2026:26568 Workarounds / mitigations: - Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. ## Package advisory (CVE-2026-33748) Affected packages: - `github.com/moby/buildkit < 0.28.1` Patched in: - `github.com/moby/buildkit 0.28.1` Source: https://osv.dev/vulnerability/GHSA-4vrq-3vrq-g6gg