CVE-2026-15791: 
Docker vulnerability analysis and mitigation

CVE-2026-15791 is a path traversal vulnerability (CWE-22) in Moby's BuildKit, a toolkit for building container images. A crafted message sent to the BuildKit low-level build API can cause a file deletion operation — normally scoped to the build container's rootfs — to escape its intended boundary and remove the contents of the host system's /tmp directory. Affected versions span from 0.10.0 up to (but not including) 0.31.2; the issue was published on July 21, 2026, and patched in v0.31.2. The CVSS v3.1 base score is 7.5 (High) per NVD scoring, while the CVSS v4.0 base score is 1.8–3.3 (Low), reflecting differing scoring methodologies (GitHub Advisory).

The root cause is improper path neutralization (CWE-22) in BuildKit's low-level LLB (Low-Level Builder) file operation handling. When a crafted API message is processed, a file deletion action intended to operate within the build container's rootfs fails to properly restrict the target path, allowing it to traverse outside the container boundary and reach the real host /tmp directory. Exploitation requires use of the low-level BuildKit API directly — it cannot be triggered through standard Dockerfile builds. A custom BuildKit frontend or direct API access would be required to craft the malicious request (GitHub Advisory).

Successful exploitation allows an attacker to delete the contents of the host system's /tmp directory, resulting in a high integrity impact on the host. While there is no confidentiality impact (no data exfiltration), clearing /tmp can disrupt running processes, corrupt temporary files relied upon by system services or applications, and potentially cause denial-of-service conditions for workloads dependent on temporary storage. The scope is limited to the host's /tmp directory and does not provide code execution or broader filesystem access (GitHub Advisory).

As of the time of publication, there is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.194%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is further constrained by the requirement for direct access to the BuildKit low-level API, which is not reachable via standard Dockerfile-based builds.

1. Identify target: Locate a BuildKit daemon (version 0.10.0–0.31.1) with its low-level API exposed, either directly on the network or accessible via a custom frontend.
2. Craft malicious LLB message: Construct a BuildKit LLB (Low-Level Builder) API message that includes a file deletion operation with a path crafted to traverse outside the container rootfs boundary (e.g., using path traversal sequences targeting /tmp on the host).
3. Submit to BuildKit API: Send the crafted message directly to the BuildKit gRPC API endpoint, bypassing the standard Dockerfile build path (which is not vulnerable).
4. Trigger host /tmp deletion: The BuildKit daemon processes the malicious file operation, which escapes the container rootfs boundary and deletes the contents of the host's /tmp directory (GitHub Advisory).

• Logs: Unexpected file deletion events targeting /tmp paths in BuildKit daemon logs; unusual LLB API calls originating from untrusted or unexpected clients.
• File System: Sudden disappearance of files and directories under the host's /tmp directory without a corresponding legitimate cleanup process; missing temporary files for running services.
• Process: BuildKit daemon (buildkitd) performing file operations outside expected container rootfs paths; unexpected errors in services relying on /tmp contents shortly after a build API call.

Upgrade BuildKit to version 0.31.2 or later, which contains the fix for this vulnerability (GitHub Advisory). As a workaround, restrict access to the BuildKit low-level API to trusted clients only, since the vulnerability cannot be triggered through standard Dockerfile builds — only through direct use of the low-level API or a custom BuildKit frontend. Network segmentation and access controls on the BuildKit API endpoint are recommended to reduce exposure until patching is possible.

The vulnerability was reported by security researcher thesecguy45 and the advisory was published by BuildKit maintainer tonistiigi on July 16, 2026 (GitHub Advisory). The issue received routine coverage from vulnerability tracking platforms including Vulners, VulDB, and CVEFeed, with no notable broader media coverage or significant community discussion observed, consistent with its low exploitability profile.