CVE-2026-15792
Received Received - Intake

BuildKit Daemon Crash via Malicious Request

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Docker Inc.

Description
A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-15792
EUVD
EUVD-2026-46311

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
docker buildkit *
docker buildkit to 0.31.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows a malicious BuildKit client or frontend to craft a request that causes the BuildKit daemon to crash with a panic. It stems from improper input validation, where the system fails to properly check input parameters before processing them.

Detection Guidance

To detect this vulnerability, check the BuildKit version on your system using the command: docker buildx version. If the version is below v0.31.2, the system is vulnerable. Additionally, monitor BuildKit daemon logs for crashes or panics that may indicate exploitation attempts.

Impact Analysis

The crash could disrupt services relying on BuildKit, leading to downtime or denial of service. If exploited repeatedly, it may cause instability in build environments. Users should avoid untrusted frontends to reduce risk.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it primarily causes a denial-of-service by crashing the BuildKit daemon. However, if the BuildKit daemon is used in systems handling sensitive data, a crash could temporarily disrupt processing, potentially impacting availability requirements under these regulations.

Mitigation Strategies

Immediately update BuildKit to version v0.31.2 or later. Avoid using BuildKit frontends from untrusted sources. Restart the BuildKit daemon after updating to ensure the patch is applied. Monitor logs for any signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15792. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart