CVE-2026-75593: 
Docker Analisi e mitigazione delle vulnerabilità

CVE-2026-75593 is a path traversal vulnerability in Moby BuildKit, a toolkit for converting source code to build artifacts. A custom client with valid permissions to access the BuildKit control API can craft an upload request that causes files to escape from the BuildKit-controlled state directory. All versions prior to 0.31.2 are affected. The vulnerability was published on August 19, 2026, and fixed in BuildKit v0.31.2. It carries a CVSS v4.0 base score of 7.2 (High) (Github Advisory, BuildKit Advisory).

The root cause is improper validation of destination directory paths during local source uploads to the BuildKit daemon, classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal) (BuildKit Advisory). An attacker with low-privilege access to the BuildKit control API can craft a malicious upload request containing path traversal sequences (e.g., ../) that bypass the daemon's destination directory validation, allowing files to be written outside the intended BuildKit-controlled state directory. Exploitation requires the attacker to already have authenticated access to the BuildKit control API — it does not affect deployments where only trusted clients such as Docker Buildx or buildctl are used (BuildKit Advisory).

Successful exploitation allows an authenticated attacker to write arbitrary files to locations outside the BuildKit-controlled state directory on the host system, with potential to escalate to remote code execution by overwriting sensitive system files, configuration files, or executable binaries (Github Advisory). The CVSS v4.0 assessment rates integrity and availability impacts as High, reflecting the risk of unauthorized file modification and potential service disruption. Environments running BuildKit as a shared service accessible to multiple or untrusted parties are most at risk (BuildKit Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.54%, placing it in the 43rd percentile for exploitation probability within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low-privilege authenticated access to the BuildKit control API, limiting the attack surface to environments where untrusted parties can issue builds (BuildKit Advisory).

1. Gain API Access: Obtain valid credentials or permissions to access the BuildKit daemon's control API — this may involve compromising a CI/CD pipeline account, a developer workstation, or exploiting a misconfigured BuildKit service exposed to untrusted users.
2. Craft Malicious Upload Request: Construct a custom BuildKit client upload request for a local source that includes path traversal sequences (e.g., ../../) in the destination path parameter, bypassing the daemon's directory validation logic.
3. Submit the Request: Send the crafted upload request to the BuildKit daemon over the network. The daemon fails to properly sanitize the destination path, allowing the file to be written outside the BuildKit-controlled state directory.
4. Achieve Arbitrary File Write: Files are written to attacker-controlled locations on the host filesystem, potentially overwriting scripts, binaries, or configuration files to achieve code execution or persistence (BuildKit Advisory, Github Advisory).

• Network: Unusual or unexpected upload requests to the BuildKit daemon control API from unfamiliar clients or IP addresses; connections from non-standard BuildKit clients (i.e., not Docker Buildx or buildctl).
• File System: Unexpected files appearing outside the BuildKit state directory (typically /var/lib/buildkit/); modification timestamps on system files or binaries coinciding with BuildKit daemon activity; new or modified files in sensitive directories such as /etc/, /usr/bin/, or cron directories.
• Logs: BuildKit daemon logs showing upload requests with path components containing ../ or URL-encoded equivalents; errors or warnings related to file path resolution in BuildKit logs.
• Process: Unexpected processes spawned from the BuildKit daemon process; new scheduled tasks or cron jobs created around the time of suspicious BuildKit activity.

Upgrade BuildKit to version 0.31.2 or later, which contains the fix for this vulnerability (BuildKit Release). As a workaround, restrict access to the BuildKit control API to only trusted clients such as Docker Buildx and buildctl, and avoid exposing the BuildKit daemon to untrusted parties (BuildKit Advisory). Environments running BuildKit as a shared multi-tenant service should treat this as a priority upgrade.