Cache Mount Issue in BuildKit on Windows Containers by Moby
CVE-2026-15788

5.6MEDIUM

Key Information:

Vendor

Moby

Status
Buildkit
Vendor
CVE Published:
20 July 2026

What is CVE-2026-15788?

A flaw exists in BuildKit's cache mount functionality on Windows Container (WCOW) workers that fails to identify NTFS directory junctions within the cache root. This oversight allows a build initiated by an untrusted user on a WCOW-configured BuildKit daemon to potentially access sensitive host files that are otherwise restricted. This vulnerability raises significant concerns around the integrity and confidentiality of host systems operating in conjunction with BuildKit's caching mechanisms.

Affected Version(s)

BuildKit Windows 0 < 0.31.2

References

https://github.com/moby/buildkit/security/advisories/GHSA...
vendor-advisory

CVSS V4

Score:
5.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Junyi Liu (mosskappa)
.