CVE-2026-15788General(mobyproject / buildkit)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch mobyproject buildkit systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root. A build authored by an untrusted user on a WCOW-configured BuildKit daemon can read arbitrary host files reachable to the BuildKit daemon process.

mobyproject CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/moby/buildkit/security/advisories/GHSA-388v-wmr2-g2v2

Weakness type (CWE)

CWE-59

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

buildkit

Threat summary

Patch or workaround signal is available
3 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
General: 2 classified signals
Peaked 2d ago at 1 mentions (2026-07-20); latest day: 1
3 total mentions across 3 days

Affected systems

Vendors

mobyproject

Products

buildkit

Deep dive

Activity timeline3 mentions / 3d

Signal classification2 categories

General

266.7%

Patch

133.3%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-20	1	Patch1
2026-08-08	1	General1
2026-08-09	1	General1

Full discourse3 posts

ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker72d
General
CVE-2026-15788 Moby Projectのbuildkitの脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/08/08/cve-2026-15788-buildkit/ #IT #Security #cybersecurity
Post summary
The provided text references an explanatory article about CVE-2026-15788 in Moby Project’s BuildKit, but it contains no explicit evidence of a PoC, exploit code, active exploitation, patch, or detailed vulnerability description.
0000043
211 followersView on X
ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker73d
General
CVE-2026-15788 Moby Projectのbuildkitの脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/08/08/cve-2026-15788-buildkit/ #IT #Security #cybersecurity
Post summary
A brief article is linked that explains the CVE-2026-15788 vulnerability in Moby Project's buildkit, covering its impact and recommended countermeasures, but no specific technical details or exploit information are provided.
0000053
211 followersView on X
VulniPulse@vulnipulse92d
Patch
⚠️ Docker BuildKit alert: CVE-2026-15788 (CVSS 5.6) Attackers could affect the listed product. Upgrade to a vendor-listed fixed release. https://vulnipulse.com/advisories/docker-cve-2026-15788 #Docker #CyberSecurity #CVE
Post summary
The advisory alerts about CVE‑2026‑15788 affecting Docker BuildKit and instructs users to upgrade to a vendor‑fixed release.
0000041
6 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	mobyproject	buildkit	-	-	-

Explore more

Back to dashboard mobyproject CVEs buildkit vulnerabilities

What researchers are saying

CVE-2026-15788

VulniPulse[verified]@vulnipulsePatch

The advisory alerts about CVE‑2026‑15788 affecting Docker BuildKit and instructs users to upgrade to a vendor‑fixed release.

ケイ | IT・セキュリティ系副業Webライター@Teeeda_workerGeneral

The provided text references an explanatory article about CVE-2026-15788 in Moby Project’s BuildKit, but it contains no explicit evidence of a PoC, exploit code, active exploitation, patch, or detailed vulnerability description.

ケイ | IT・セキュリティ系副業Webライター@Teeeda_workerGeneral

A brief article is linked that explains the CVE-2026-15788 vulnerability in Moby Project's buildkit, covering its impact and recommended countermeasures, but no specific technical details or exploit information are provided.