CVE-2026-75593 in BuildKit
Summary
by MITRE • 08/20/2026
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access BuildKit control API to issue builds, eg., bypass authentication, etc. This issue is fixed in version 0.31.2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/20/2026
BuildKit serves as a critical component in modern containerized development workflows, functioning as the engine behind tools like Docker Buildx and Tekton by converting source code into build artifacts with high efficiency and repeatability. The architecture relies on a client-server model where clients communicate with a central daemon to orchestrate complex builds. In versions prior to 0.31.2, this communication channel contained a significant security flaw related to path traversal during file uploads. Specifically, the BuildKit daemon failed to adequately sanitize or validate paths provided by custom clients when handling upload requests intended for the build context. This lack of rigorous input validation allowed an attacker with valid permissions on the BuildKit control API to craft malicious requests that directed file writes outside of the designated state directory controlled by BuildKit.
The technical nature of this vulnerability is classified as a path traversal or arbitrary file write issue, which aligns closely with CWE-22: Improper Limitation of a Pathname to a Restricted Directory and CWE-732: Incorrect Permission Assignment for Critical Resource. By exploiting the insufficient validation of upload paths, an authenticated client could bypass the sandboxing mechanisms intended to isolate build processes from the host system's broader filesystem. This escape capability means that files created or modified during the build process are not confined to the expected temporary or state directories but can be written to arbitrary locations on the underlying operating system where the BuildKit daemon is running.
The operational impact of this vulnerability is severe, particularly in shared environments such as CI/CD pipelines or multi-tenant cloud infrastructure. An attacker who has obtained valid credentials for the BuildKit API could leverage this flaw to write malicious scripts, configuration files, or binaries into sensitive directories on the host machine. This action can lead to privilege escalation if the daemon runs with elevated privileges, allowing the attacker to execute code as root or other high-privilege accounts. Furthermore, it enables potential data exfiltration by writing stolen information to accessible locations and facilitates persistence mechanisms by placing backdoors in system startup scripts or service configurations. The ability to write outside the sandbox effectively breaks the isolation guarantees that BuildKit is designed to provide, turning a build tool into an attack vector against the host infrastructure.
Mitigation strategies primarily involve upgrading to version 0.31.2 or later, where this path validation logic has been corrected to ensure all file operations remain strictly within the allowed state directories. In environments where immediate patching is not feasible, strict access control policies should be enforced on the BuildKit API endpoint to limit which users and services can initiate builds. Additionally, running the BuildKit daemon with minimal required privileges using principles of least privilege can reduce the impact if an escape occurs. Network segmentation and monitoring for unusual file system activity in directories outside standard build contexts are also recommended defensive measures to detect potential exploitation attempts aligned with ATT&CK techniques such as T1059 Command and Scripting Interpreter or T1486 Data Encrypted for Impact, depending on the payload delivered via the arbitrary write.