What’s Vulnerable › Vulnerabilities

CVE-2026-75593: BuildKit: Malicious client can bypass destination directory validation on local sources upload

• Severity: high (CVSS 7.2 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-19 · updated 2026-09-09
• Weakness: CWE-22

Description

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access BuildKit control API to issue builds, eg., bypass authentication, etc. This issue is fixed in version 0.31.2.

Affected products

• moby BuildKit: before 0.31.2

References

• https://github.com/moby/buildkit/releases/tag/v0.31.2
• https://github.com/moby/buildkit/security/advisories/GHSA-g2h8-426c-7976

Get alerted when CVE-2026-75593 or the next vulnerability affects your stack