Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
⚠️ Docker BuildKit alert: CVE-2026-15789 (CVSS 6.9) Attackers could bypass authentication. Upgrade to a vendor-listed fixed release. https://vulnipulse.com/advisories/docker-cve-2026-15789 #Docker #BuildKit #CyberSecurity #CVE
Post summary
CVE-2026-15789 enables authentication bypass in Docker BuildKit; a fixed release is available and users should upgrade per the advisory.
CVE-2026-15789 A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have… https://www.cve.org/CVERecord?id=CVE-2026-15789
Post summary
CVE‑2026‑15789 describes a BuildKit upload request flaw that allows files to escape the sandboxed state directory, but it contains no proof‑of‑concept, exploit code, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | mobyproject | buildkit | - | - | - |