---
id: CVE-2026-75593
title: >-
  BuildKit is a toolkit for converting source code to build artifacts in an
  efficient, expressive and repeatable manner
summary: >-
  BuildKit is a toolkit for converting source code to build artifacts in an
  efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client
  can produce such an upload request to the BuildKit daemon that files can
  escape from …
severity: high
cvss: 7.2
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-22
vendor: moby
product: buildkit
affected:
  - buildkit < 0.31.2
published: '2026-08-19'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:15:59.613'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75593'
references:
  - url: 'https://github.com/moby/buildkit/releases/tag/v0.31.2'
    label: security-advisories@github.com
  - url: 'https://github.com/moby/buildkit/security/advisories/GHSA-g2h8-426c-7976'
    label: security-advisories@github.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-75593.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-75593'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2519913'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-75593'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75593'
  - url: 'https://access.redhat.com/errata/RHSA-2026:66521'
  - url: 'https://access.redhat.com/errata/RHSA-2026:66022'
  - url: 'https://access.redhat.com/errata/RHSA-2026:51065'
  - url: 'https://access.redhat.com/errata/RHSA-2026:52807'
  - url: 'https://access.redhat.com/errata/RHSA-2026:50953'
  - url: 'https://access.redhat.com/errata/RHSA-2026:69255'
  - url: 'https://access.redhat.com/errata/RHSA-2026:69917'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-08-25T14:02:16.589697Z'
cvssSource: cna
ingestedAt: '2026-09-12T23:00:30.746Z'
epss: 0.0054
epssPercentile: 0.44388
patched:
  - logging_subsystem_for_red_hat_openshift 6.6
  - openshift_api_for_data_protection 1.5
  - hardened_images
scores:
  cna: 7.2
  vendor: 6.5
---

## Overview

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access BuildKit control API to issue builds, eg., bypass authentication, etc. This issue is fixed in version 0.31.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:66521** · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.6 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66521)
- **RHSA-2026:66022** · Red Hat · fixed in: OpenShift API for Data Protection 1.5 · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66022)
- **RHSA-2026:51065** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51065)
- **RHSA-2026:52807** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:52807)
- **RHSA-2026:50953** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:50953)
- **Red Hat VEX** · Moderate · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Compliance Operator, Confidential Compute Attestation, Kernel Module Management Operator for Red Hat Openshift, Logical Volume Manager Storage, Migration Toolkit for Containers, … · no fix planned: OpenShift Lightspeed, Red Hat Developer Hub, Migration Toolkit for Virtualization, OpenShift Developer Tools and Services, … · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-75593.json)
- **RHSA-2026:69255** · Red Hat · fixed in: Red Hat Quay 3.16 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69255)
- **RHSA-2026:69917** · Red Hat · fixed in: OpenShift Developer Tools and Services 1.6.4 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:69917)