CVE-2026-15793: 
Docker vulnerability analysis and mitigation

CVE-2026-15793 is an argument injection vulnerability in Moby BuildKit that allows a malicious Git source to trigger crafted command invocations on the host system. It affects BuildKit versions v0.30.0 through v0.31.1 and was published on July 21, 2026, with the advisory first disclosed on July 16, 2026. The vulnerability is classified as Moderate severity by the vendor and carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 7.3 (High) (GitHub Advisory).

The root cause is improper neutralization of argument delimiters in a command (CWE-88 — Argument Injection). BuildKit custom frontends or clients using the raw low-level API can set the git.checkoutbundle=true option when checking out Git sources; if the Git repository is attacker-controlled, this flag enables a crafted command invocation on the host by injecting malicious arguments into the Git bundle checkout process. Exploitation requires a custom frontend (not standard Dockerfile builds) combined with a malicious Git source, meaning standard Docker builds are not affected (GitHub Advisory).

Successful exploitation allows an attacker who controls a malicious Git repository to achieve arbitrary command execution on the BuildKit host system. The CVSS v4.0 scoring reflects high confidentiality, integrity, and availability impacts on the vulnerable system. The attack is limited to scenarios where a custom BuildKit frontend or raw low-level API client is used with git.checkoutbundle=true, reducing the overall exposure compared to a universal RCE (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The NVD SSVC assessment confirms exploitation is "none" and the vulnerability is not automatable. The EPSS score is approximately 0.396%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

The issue has been fixed in BuildKit v0.31.2 and later; users should upgrade immediately (GitHub Advisory). As a workaround, avoid enabling the git.checkoutbundle=true option in custom frontends or raw low-level API clients, and restrict access to the BuildKit raw low-level API to trusted clients only. Standard Dockerfile builds are not affected and do not require immediate action beyond upgrading the BuildKit daemon.

The vulnerability was reported by Zhibin Hu and Lei Wang of HuaweiCloud and was published by BuildKit maintainer tonistiigi via a GitHub Security Advisory (GitHub Advisory). Community coverage has been limited to automated vulnerability tracking platforms such as Vulners, VulDB, and Tenable Nessus plugin updates, with no notable independent researcher commentary or significant media coverage observed.