CVE-2026-15792: 
Docker vulnerability analysis and mitigation

CVE-2026-15792 is a Denial of Service vulnerability in Moby BuildKit, the toolkit for building container images, where a malicious BuildKit client or frontend could craft a request that causes the BuildKit daemon to crash with a panic. It affects all BuildKit versions up to and including v0.31.1, with the fix introduced in v0.31.2. The vulnerability was published on July 21, 2026, and assigned a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.0 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-20 (Improper Input Validation): BuildKit does not adequately validate parameters received from a client or frontend before processing them, allowing a specially crafted request to trigger an unhandled panic in the daemon process. The attack vector is network-based, requiring no user interaction, and in the CVSS v3.1 assessment, no privileges are required; however, the CVSS v4.0 assessment notes that some attack requirements (such as the ability to connect to the BuildKit daemon) must be present. The vulnerable code path is exercised when a malicious or compromised frontend — typically specified via the #syntax directive in a Dockerfile or the --frontend flag with buildctl build — sends incorrect parameters to the daemon (GitHub Advisory).

Successful exploitation results in a Denial of Service: the BuildKit daemon crashes with a panic, interrupting all ongoing and queued container image builds. There is no confidentiality or integrity impact — the vulnerability is limited to availability. In CI/CD environments where BuildKit is a critical build infrastructure component, repeated exploitation could cause sustained service disruption and pipeline failures (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.38%, indicating a low probability of exploitation in the near term. NVD's SSVC assessment classifies exploitation as "none" and the vulnerability as not automatable, reflecting the requirement for an attacker to have access to the BuildKit daemon (Feedly).

1. Identify target: Locate a BuildKit daemon (v0.31.1 or earlier) accessible over the network, such as in a CI/CD environment where the daemon socket is exposed.
2. Prepare malicious frontend or client: Craft a custom BuildKit frontend image or client that sends a request with incorrect or malformed parameters to the BuildKit daemon — for example, by specifying a malicious #syntax image in a Dockerfile or using buildctl build --frontend with a crafted frontend.
3. Trigger the panic: Submit a build request using the malicious frontend or client. The BuildKit daemon fails to validate the parameters, encounters an unhandled condition, and crashes with a Go panic.
4. Result: The BuildKit daemon process terminates, causing a Denial of Service for all users and build pipelines relying on that daemon instance (GitHub Advisory).

• Logs: BuildKit daemon logs showing unexpected Go panic stack traces (e.g., panic: followed by a goroutine dump) around the time of a build request from an unfamiliar frontend image.
• Process: Sudden termination of the buildkitd process without a graceful shutdown signal; process restart events in system logs (e.g., systemd reporting buildkitd service restarted).
• Network: Build requests originating from unexpected or untrusted client IPs connecting to the BuildKit daemon socket or API endpoint.
• File System: Presence of unfamiliar or unsigned frontend images referenced in Dockerfiles (unusual #syntax directives pointing to external or unknown registries) (GitHub Advisory).

Upgrade BuildKit to v0.31.2 or later, which contains the fix for this vulnerability (GitHub Advisory). As a workaround, avoid using BuildKit frontends from untrusted sources — only allow frontend images specified via #syntax or --frontend from verified, trusted registries. Additionally, restrict network access to the BuildKit daemon to only trusted clients using firewall rules or network-level access controls, and monitor daemon logs for unexpected crashes or suspicious build requests (Feedly). Red Hat has also issued advisories (RHSA-2026:44152, RHSA-2026:46988) for affected downstream packages (Red Hat Advisory 1, Red Hat Advisory 2).

The advisory was published by BuildKit maintainer tonistiigi on GitHub on July 16, 2026, and assigned a "Moderate" severity rating by the project (GitHub Advisory). Red Hat issued errata advisories (RHSA-2026:44152 and RHSA-2026:46988) addressing the vulnerability in downstream products. Coverage has been limited to automated vulnerability tracking platforms such as Vulners, VulDB, and CVEfeed, with no notable independent researcher commentary or significant social media discussion observed (Feedly).