Approved changes feed: RSS · Atom
cpe:2.3:a:moby:buildkit:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Moby (8d314c79-7a19-5d13-b09a-3981653aa3ea) |
|---|---|
| Product | Buildkit (9123dcf2-6113-5813-bcad-646766523905) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-15793 |
vulnerable | 2026-07-29 00:26:18.462101 |
Git source checkout from a bundle file could lead to command injection
BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host.
Published: 2026-07-21T16:10:21.790Z
Updated: 2026-07-21T16:58:40.200Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15792 |
vulnerable | 2026-07-29 00:26:18.461856 |
Possible panic when incorrect parameters sent from frontend
A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic.
Published: 2026-07-21T16:10:21.395Z
Updated: 2026-07-21T17:01:55.840Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15791 |
vulnerable | 2026-07-29 00:26:18.461719 |
LLB file operation can be tricked to remove /tmp directory contents
A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory.
Published: 2026-07-21T16:10:20.881Z
Updated: 2026-07-21T17:08:54.555Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15789 |
vulnerable | 2026-07-29 00:26:18.461465 |
Malicious client can bypass destination directory validation on local sources upload
A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc.
Published: 2026-07-21T16:10:20.421Z
Updated: 2026-07-21T17:13:36.248Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15788 |
vulnerable | 2026-07-29 00:26:18.461239 |
WCOW cache mount source selector resolves NTFS junctions outside of cache root
BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root. A build authored by an untrusted user on a WCOW-configured BuildKit daemon can read arbitrary host files reachable to the BuildKit daemon process.
Published: 2026-07-20T19:12:56.386Z
Updated: 2026-07-21T12:40:56.055Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33748 |
vulnerable | 2026-06-08 07:59:10.693561 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33747 |
vulnerable | 2026-06-08 07:59:10.691678 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-23653 |
vulnerable | 2026-06-08 06:29:40.091433 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-23652 |
vulnerable | 2026-06-08 06:29:40.090840 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-23651 |
vulnerable | 2026-06-08 06:29:40.090210 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-23650 |
vulnerable | 2026-06-08 06:29:40.088515 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-26054 |
vulnerable | 2026-06-08 05:57:37.943676 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.