Vulnerability Details CVE-2026-15791
A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 4.3%
CVSS Severity
CVSS v3 Score 7.5
Products affected by CVE-2026-15791
-
cpe:2.3:a:mobyproject:buildkit:0.10.0
-
cpe:2.3:a:mobyproject:buildkit:0.10.1
-
cpe:2.3:a:mobyproject:buildkit:0.10.2
-
cpe:2.3:a:mobyproject:buildkit:0.10.3
-
cpe:2.3:a:mobyproject:buildkit:0.10.4
-
cpe:2.3:a:mobyproject:buildkit:0.10.5
-
cpe:2.3:a:mobyproject:buildkit:0.10.6
-
cpe:2.3:a:mobyproject:buildkit:0.11.0
-
cpe:2.3:a:mobyproject:buildkit:0.11.1
-
cpe:2.3:a:mobyproject:buildkit:0.11.2
-
cpe:2.3:a:mobyproject:buildkit:0.11.3
-
cpe:2.3:a:mobyproject:buildkit:0.11.4
-
cpe:2.3:a:mobyproject:buildkit:0.11.5
-
cpe:2.3:a:mobyproject:buildkit:0.11.6
-
cpe:2.3:a:mobyproject:buildkit:0.12.0
-
cpe:2.3:a:mobyproject:buildkit:0.12.1
-
cpe:2.3:a:mobyproject:buildkit:0.12.2
-
cpe:2.3:a:mobyproject:buildkit:0.12.3
-
cpe:2.3:a:mobyproject:buildkit:0.12.4
-
cpe:2.3:a:mobyproject:buildkit:0.12.5
-
cpe:2.3:a:mobyproject:buildkit:0.13.0
-
cpe:2.3:a:mobyproject:buildkit:0.13.1
-
cpe:2.3:a:mobyproject:buildkit:0.13.2
-
cpe:2.3:a:mobyproject:buildkit:0.14.0
-
cpe:2.3:a:mobyproject:buildkit:0.14.1
-
cpe:2.3:a:mobyproject:buildkit:0.15.0
-
cpe:2.3:a:mobyproject:buildkit:0.15.1
-
cpe:2.3:a:mobyproject:buildkit:0.15.2
-
cpe:2.3:a:mobyproject:buildkit:0.16.0
-
cpe:2.3:a:mobyproject:buildkit:0.17.0
-
cpe:2.3:a:mobyproject:buildkit:0.17.1
-
cpe:2.3:a:mobyproject:buildkit:0.17.2
-
cpe:2.3:a:mobyproject:buildkit:0.17.3
-
cpe:2.3:a:mobyproject:buildkit:0.18.0
-
cpe:2.3:a:mobyproject:buildkit:0.18.1
-
cpe:2.3:a:mobyproject:buildkit:0.18.2
-
cpe:2.3:a:mobyproject:buildkit:0.19.0
-
cpe:2.3:a:mobyproject:buildkit:0.20.0
-
cpe:2.3:a:mobyproject:buildkit:0.20.1
-
cpe:2.3:a:mobyproject:buildkit:0.20.2
-
cpe:2.3:a:mobyproject:buildkit:0.21.0
-
cpe:2.3:a:mobyproject:buildkit:0.21.1
-
cpe:2.3:a:mobyproject:buildkit:0.22.0
-
cpe:2.3:a:mobyproject:buildkit:0.23.0
-
cpe:2.3:a:mobyproject:buildkit:0.23.1
-
cpe:2.3:a:mobyproject:buildkit:0.23.2
-
cpe:2.3:a:mobyproject:buildkit:0.24.0
-
cpe:2.3:a:mobyproject:buildkit:0.25.0
-
cpe:2.3:a:mobyproject:buildkit:0.25.1
-
cpe:2.3:a:mobyproject:buildkit:0.25.2
-
cpe:2.3:a:mobyproject:buildkit:0.26.0
-
cpe:2.3:a:mobyproject:buildkit:0.26.1
-
cpe:2.3:a:mobyproject:buildkit:0.26.2
-
cpe:2.3:a:mobyproject:buildkit:0.26.3
-
cpe:2.3:a:mobyproject:buildkit:0.27.0
-
cpe:2.3:a:mobyproject:buildkit:0.27.1
-
cpe:2.3:a:mobyproject:buildkit:0.28.0
-
cpe:2.3:a:mobyproject:buildkit:0.28.1
-
cpe:2.3:a:mobyproject:buildkit:0.29.0
-
cpe:2.3:a:mobyproject:buildkit:0.3.0
-
cpe:2.3:a:mobyproject:buildkit:0.3.1
-
cpe:2.3:a:mobyproject:buildkit:0.3.2
-
cpe:2.3:a:mobyproject:buildkit:0.3.3
-
cpe:2.3:a:mobyproject:buildkit:0.30.0
-
cpe:2.3:a:mobyproject:buildkit:0.31.0
-
cpe:2.3:a:mobyproject:buildkit:0.31.1
-
cpe:2.3:a:mobyproject:buildkit:0.4.0
-
cpe:2.3:a:mobyproject:buildkit:0.5.0
-
cpe:2.3:a:mobyproject:buildkit:0.5.1
-
cpe:2.3:a:mobyproject:buildkit:0.6.0
-
cpe:2.3:a:mobyproject:buildkit:0.6.1
-
cpe:2.3:a:mobyproject:buildkit:0.6.2
-
cpe:2.3:a:mobyproject:buildkit:0.6.3
-
cpe:2.3:a:mobyproject:buildkit:0.6.4
-
cpe:2.3:a:mobyproject:buildkit:0.7.0
-
cpe:2.3:a:mobyproject:buildkit:0.7.1
-
cpe:2.3:a:mobyproject:buildkit:0.7.2
-
cpe:2.3:a:mobyproject:buildkit:0.8.0
-
cpe:2.3:a:mobyproject:buildkit:0.8.1
-
cpe:2.3:a:mobyproject:buildkit:0.8.2
-
cpe:2.3:a:mobyproject:buildkit:0.8.3
-
cpe:2.3:a:mobyproject:buildkit:0.9.0
-
cpe:2.3:a:mobyproject:buildkit:0.9.1
-
cpe:2.3:a:mobyproject:buildkit:0.9.2
-
cpe:2.3:a:mobyproject:buildkit:0.9.3