CVE-2026-15788
Awaiting Analysis Awaiting Analysis - Queue

BuildKit Cache Mount NTFS Junction Bypass on Windows

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: Docker Inc.

Description
BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root. A build authored by an untrusted user on a WCOW-configured BuildKit daemon can read arbitrary host files reachable to the BuildKit daemon process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-15788
EUVD
EUVD-2026-46074

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
docker buildkit to 0.31.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects BuildKit's cache mount source selector on Windows Container on Windows (WCOW) workers. It fails to detect NTFS directory junctions inside the cache root, allowing untrusted builds to read arbitrary host files accessible to the BuildKit daemon process.

Detection Guidance

To detect this vulnerability, check the BuildKit version on your system. Run: docker buildx version. If the version is prior to 0.31.2, the system is vulnerable. Additionally, inspect Docker daemon logs for unusual file access patterns or unauthorized cache mount operations.

Impact Analysis

An attacker with access to a WCOW-configured BuildKit daemon could craft a build that reads sensitive host files, potentially exposing confidential data. The attack requires local access but no elevated privileges or user interaction.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements like GDPR (data protection) or HIPAA (health information privacy). Unauthorized file access may result in data breaches and regulatory penalties.

Mitigation Strategies

Upgrade BuildKit to version 0.31.2 or later. Use trusted build sources and avoid running untrusted builds on Windows Container on Windows (WCOW) configurations. Monitor for suspicious activity in Docker daemon logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15788. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart