PT-2026-61699 · Buildkit · Buildkit

Junyi Liu · CVE-2026-15788 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v4.0

5.6

Medium

Base vector

AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions BuildKit (affected versions not specified)

Description On Windows Container on Windows (WCOW) workers, the cache mount source= selector fails to detect NTFS directory junctions located within the cache root. This allows an untrusted user to read arbitrary host files that are accessible to the BuildKit daemon process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2026-15788

Affected Products

Buildkit

References · 3

• https://github.com/moby/buildkit/security/advisories/GHSA-388v-wmr2-g2v2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-15788 · Security Note
• https://twitter.com/vulnipulse/status/2079295090770788406 · Twitter Post