PatchTheCVEbuildkit vulnerabilities and fixes
Recent CVEs affecting buildkit, with upgrade or downgrade steps. 5 tracked.
buildkit has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-07-21. Highest priority: CVE-2026-15788 (score 45/100).
- CVE-2026-15788 HIGH 7.5 UPGRADE BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS di
- CVE-2026-15789 HIGH 7.5 UPGRADE A custom client can produce such an upload request to the BuildKit daemon that files can escape from the Build
- CVE-2026-15791 HIGH 7.5 UPGRADE A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory
- CVE-2026-15792 HIGH 7.5 UPGRADE A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with
- CVE-2026-15793 HIGH 7.5 UPGRADE BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking
FAQ
How do I fix buildkit vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is buildkit being exploited right now?
None of the tracked buildkit CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which buildkit CVE should I patch first?
CVE-2026-15788 currently ranks highest (45/100): BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS di.