CVE-2026-15792: 
Docker vulnerability analysis and mitigation

CVE-2026-15792 is an improper input validation vulnerability in Moby BuildKit that allows a malicious BuildKit client or frontend to craft a request causing the BuildKit daemon to crash with a panic. It affects BuildKit versions up to and including v0.31.1, with v0.31.2 and later containing the fix. The vulnerability was published on July 21, 2026, and is currently undergoing analysis. It carries a CVSS v4.0 base score of 6.0–6.3 (Medium severity) (GitHub Advisory, Feedly).

The root cause is improper input validation (CWE-20) in the BuildKit daemon's handling of requests from clients or frontends. When a malicious or malformed request with incorrect parameters is received, the daemon fails to validate the input properly, triggering a Go runtime panic and crashing the service. The attack vector is network-based, requires low privileges, and has no user interaction requirement, though attack requirements (AT:P) indicate some preconditions must be met — specifically, the attacker must be able to interact with the BuildKit daemon as a client or supply a malicious frontend image (e.g., via the #syntax directive in a Dockerfile or the --frontend flag in buildctl build) (GitHub Advisory).

Successful exploitation results in a denial-of-service condition: the BuildKit daemon crashes with a panic, disrupting all ongoing and future build operations until the service is restarted. There is no confidentiality or integrity impact — the vulnerability is limited to availability. In CI/CD environments where BuildKit is central to container image builds, exploitation could halt pipelines and delay software delivery (GitHub Advisory, Feedly).

1. Identify target: Locate a BuildKit daemon (v0.31.1 or earlier) accessible over the network, either directly via the BuildKit API socket or through a Docker host exposing BuildKit functionality.
2. Prepare malicious frontend or client request: Craft a request with incorrect or malformed parameters — for example, by specifying a malicious frontend image via the #syntax directive in a Dockerfile or using the --frontend flag with buildctl build to point to an attacker-controlled image.
3. Submit the crafted request: Send the malformed request to the BuildKit daemon using buildctl or a compatible BuildKit client library, triggering the improper input validation path.
4. Trigger daemon panic: The BuildKit daemon fails to validate the malformed parameters, causing a Go runtime panic and crashing the daemon process, resulting in a denial-of-service condition (GitHub Advisory).

• Logs: Unexpected BuildKit daemon crash logs containing Go panic stack traces (e.g., panic: followed by a goroutine dump in BuildKit daemon output or system journal).
• Process: Sudden termination of the buildkitd process; repeated restarts of the BuildKit daemon service in a short time window.
• Network: Unusual or repeated build requests originating from unexpected clients or referencing unknown/external frontend images in the #syntax directive.
• File System: Presence of unfamiliar or externally-sourced frontend images in the local container image cache that were referenced in recent build operations (GitHub Advisory).

Upgrade BuildKit to v0.31.2 or later, which contains the fix for this vulnerability. As a workaround where upgrading is not immediately possible, avoid using BuildKit frontends from untrusted sources — this means ensuring the #syntax line in Dockerfiles and the --frontend flag in buildctl build commands only reference trusted, verified frontend images. Docker also released docker-v29.6.2, which incorporates the BuildKit fix (GitHub Advisory, Docker Release).

The advisory was published by BuildKit maintainer tonistiigi on GitHub on July 16, 2026, and formally assigned a CVE on July 21, 2026. Community discussion has been limited, with mentions in package management newsletters and Solus Linux community forums noting the release of BuildKit v0.31.2 as part of routine update coverage. No significant independent researcher commentary or major media coverage has been identified (GitHub Advisory, Solus Forum, Package Mgmt Blog).