CVE-2026-15791 — LLB file operation can be tricked to remove /tmp directory contents

CVE-2026-15791

LLB file operation can be tricked to remove /tmp directory contents PUBLISHED

Description (CNA)

A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory.

Affected (CNA)

Vendor / product	Versions
moby / BuildKit	affected 0.10.0 before 0.31.2

CWE

CWE-22

References

https://github.com/moby/buildkit/security/advisories/GHSA-32pv-7hq5-qhwq

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.