CVE-2026-15788 — WCOW cache mount source selector resolves NTFS junctions outside of cache root

CVE-2026-15788

WCOW cache mount source selector resolves NTFS junctions outside of cache root PUBLISHED

Description (CNA)

BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root. A build authored by an untrusted user on a WCOW-configured BuildKit daemon can read arbitrary host files reachable to the BuildKit daemon process.

Affected (CNA)

Vendor / product	Versions
moby / BuildKit	affected 0 before 0.31.2

CWE

CWE-59

References

https://github.com/moby/buildkit/security/advisories/GHSA-388v-wmr2-g2v2

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.