Red Hat Security Advisory

RHSA-2026:51065

Red Hat Hardened Images RPMs Security Update

Released 2026-08-06 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images buildah-2:1.45.0-2.hum1@aarch64, buildah-2:1.45.0-2.hum1@src, buildah-2:1.45.0-2.hum1@x86_64

Fixes 4 records

TI-2026-52903 CVE-2026-75593 · GHSA-wqjv-cjqw-p7p5

BuildKit: Malicious client can bypass destination directory validation on local sources upload

MEDIUM 40

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00541 Published 2026-08-19 Partial fix · 0.31.2 CWE-22

TI-2026-40992 CVE-2026-56852 · GHSA-jpjm-c3r5-q96r

Infinite loop on invalid input in golang.org/x/text

LOW 39

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00475 Published 2026-07-21 Partial fix · 0.39.0 CWE-835

TI-2026-13283 CVE-2026-15789

Malicious client can bypass destination directory validation on local sources upload

LOW 30

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory.

CVSS 4.0MEDIUM 6.9 Local Low privileges No interaction EPSS 0.00314 Published 2026-07-21 Partial fix · 0.31.2 CWE-22

TI-2026-13282 CVE-2026-15788

WCOW cache mount source selector resolves NTFS junctions outside of cache root

LOW 25

BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root.

CVSS 4.0MEDIUM 5.6 Local No auth User interaction EPSS 0.00411 Published 2026-07-20 Fixed in 0.31.2 CWE-59