CVE-2026-15793 - Vulnerability Details - OpenCVE

BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction Active

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

No data.

References

Link	Providers
https://github.com/moby/buildkit/security/advisories/GHSA-hw3h-2gp9-cxpv

History

Tue, 21 Jul 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 21 Jul 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host.
Title		Git source checkout from a bundle file could lead to command injection
Weaknesses		CWE-88
References		https://github.com/moby/buildkit/security/advisories/GHSA-hw3h-2gp9-cxpv
Metrics		cvssV4_0 `{'score': 6.5, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: Docker

Published: 2026-07-21T16:10:21.790Z

Updated: 2026-07-21T16:58:40.200Z

Reserved: 2026-07-14T19:31:45.116Z

Link: CVE-2026-15793

Vulnrichment

Updated: 2026-07-21T16:58:31.222Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15793", "assignerOrgId": "686469e6-3ff6-451b-ab8b-cf5b9e89401e", "state": "PUBLISHED", "assignerShortName": "Docker", "dateReserved": "2026-07-14T19:31:45.116Z", "datePublished": "2026-07-21T16:10:21.790Z", "dateUpdated": "2026-07-21T16:58:40.200Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Linux", "MacOS", "Windows"], "product": "BuildKit", "vendor": "moby", "versions": [{"version": "0.30.0", "status": "affected", "lessThanOrEqual": "0.31.1", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Zhibin Hu of HuaweiCloud"}, {"lang": "en", "type": "finder", "value": "Lei Wang of HuaweiCloud"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host."}], "value": "BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host."}], "impacts": [{"capecId": "CAPEC-137", "descriptions": [{"lang": "en", "value": "CAPEC-137 Parameter Injection"}]}], "metrics": [{"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-88", "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "686469e6-3ff6-451b-ab8b-cf5b9e89401e", "shortName": "Docker", "dateUpdated": "2026-07-21T16:10:21.790Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://github.com/moby/buildkit/security/advisories/GHSA-hw3h-2gp9-cxpv"}], "source": {"discovery": "EXTERNAL"}, "title": "Git source checkout from a bundle file could lead to command injection", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The issue requires using a custom frontend together with a malicious Git source. Current Dockerfile builds are not affected."}], "value": "The issue requires using a custom frontend together with a malicious Git source. Current Dockerfile builds are not affected."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-21T16:57:48.480624Z", "id": "CVE-2026-15793", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-21T16:58:40.200Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-15793", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-21T16:57:48.480624Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-21T16:58:31.222Z"}}], "cna": {"title": "Git source checkout from a bundle file could lead to command injection", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Zhibin Hu of HuaweiCloud"}, {"lang": "en", "type": "finder", "value": "Lei Wang of HuaweiCloud"}], "impacts": [{"capecId": "CAPEC-137", "descriptions": [{"lang": "en", "value": "CAPEC-137 Parameter Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "moby", "product": "BuildKit", "versions": [{"status": "affected", "version": "0.30.0", "versionType": "semver", "lessThanOrEqual": "0.31.1"}], "platforms": ["Linux", "MacOS", "Windows"], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/moby/buildkit/security/advisories/GHSA-hw3h-2gp9-cxpv", "tags": ["vendor-advisory"]}], "workarounds": [{"lang": "en", "value": "The issue requires using a custom frontend together with a malicious Git source. Current Dockerfile builds are not affected.", "supportingMedia": [{"type": "text/html", "value": "The issue requires using a custom frontend together with a malicious Git source. Current Dockerfile builds are not affected.", "base64": false}]}], "descriptions": [{"lang": "en", "value": "BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host.", "supportingMedia": [{"type": "text/html", "value": "BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-88", "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')"}]}], "providerMetadata": {"orgId": "686469e6-3ff6-451b-ab8b-cf5b9e89401e", "shortName": "Docker", "dateUpdated": "2026-07-21T16:10:21.790Z"}}}, "cveMetadata": {"cveId": "CVE-2026-15793", "state": "PUBLISHED", "dateUpdated": "2026-07-21T16:58:40.200Z", "dateReserved": "2026-07-14T19:31:45.116Z", "assignerOrgId": "686469e6-3ff6-451b-ab8b-cf5b9e89401e", "datePublished": "2026-07-21T16:10:21.790Z", "assignerShortName": "Docker"}, "dataVersion": "5.2"}