CVE-2026-15791: LLB file operation can be tricked to remove /tmp directory contents
A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15791?
CVE-2026-15791 has a severity rating of low with a CVSS score of 4.0.
How does CVE-2026-15791 impact Docker BuildKit?
CVE-2026-15791 allows a crafted message to remove contents from the /tmp directory of the host when using Docker BuildKit.
How can I mitigate CVE-2026-15791?
Mitigation for CVE-2026-15791 involves ensuring that Docker BuildKit is not used in contexts where untrusted input can be processed.
Is it necessary to patch CVE-2026-15791?
While the severity is low, it is advisable to patch or apply appropriate mitigations to avoid potential data loss.
What software is affected by CVE-2026-15791?
CVE-2026-15791 affects Docker BuildKit, specifically versions that allow path traversal vulnerabilities.