Read the docs
TI-2026-13286 Aliases CVE-2026-15792

Possible panic when incorrect parameters sent from frontend

Priority LOW 28CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 12 fixed, 19 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00243 15th percentileScored 2026-11-07
Fix Partial BuildKit (moby): 0.31.2Red Hat: 14 advisoriesRed Hat: 12 fixed, 19 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mobyBuildKitbefore 0.31.20.31.2Patch availableCNA
  • BuildKit Vendormoby Affected before 0.31.2 Fixed in 0.31.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mobyproject:buildkit:*:*:*:*:*:*:*:*before 0.31.2VulnerableMobyproject
  • cpe:2.3:a:mobyproject:buildkit:*:*:*:*:*:*:*:* Versions before 0.31.2 Vulnerable ·Mobyproject

Remediation

  • Fix · CNA BuildKit (moby) Fixed in 0.31.2

Red Hat 14 advisories

  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:81110 Released 2026-10-12 · Red Hat rating Important
    Red Hat Quay 3.18.1
    • Red Hat Quay 3.18 registry.redhat.io/quay/quay-builder-rhel9, registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:74511 Released 2026-10-01 · Red Hat rating Important
    Red Hat Quay 3.17.5
    • Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
Show 11 more Red Hat advisories
  • RHSA-2026:70267 Released 2026-09-22 · Red Hat rating Important
    Red Hat Quay 3.14.9
    • Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:69255 Released 2026-09-21 · Red Hat rating Important
    Red Hat Quay 3.16.6
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:68349 Released 2026-09-16 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.2.13
    • Logging Subsystem for Red Hat OpenShift 6.2 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/loki-rhel9-operator +2
  • RHSA-2026:66523 Released 2026-09-10 · Red Hat rating Important
    Red Hat Quay 3.12.22
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:66521 Released 2026-09-10 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.6.1
    • Logging Subsystem for Red Hat OpenShift 6.6 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/lokistack-gateway-rhel9 +1
  • RHSA-2026:66084 Released 2026-09-09 · Red Hat rating Important
    Red Hat Quay 3.10.26
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:66022 Released 2026-09-09 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection
    • OpenShift API for Data Protection 1.5 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +4
  • RHSA-2026:65514 Released 2026-09-08 · Red Hat rating Important
    Red Hat Quay 3.9.26
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:46988 Released 2026-07-27 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images trivy-0.72.0-0.1.2.hum1@aarch64, trivy-0.72.0-0.1.2.hum1@src, trivy-0.72.0-0.1.2.hum1@x86_64
  • RHSA-2026:44152 Released 2026-07-23 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images podman-5:6.0.2-2.1.hum1@aarch64, podman-5:6.0.2-2.1.hum1@src, podman-5:6.0.2-2.1.hum1@x86_64 +10
  • RHSA-2026:43122 Released 2026-07-22 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images buildah-2:1.44.0-3.2.hum1@aarch64, buildah-2:1.44.0-3.2.hum1@src, buildah-2:1.44.0-3.2.hum1@x86_64 +2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    moby BuildKit 0.31.2

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-13283 Malicious client can bypass destination directory validation on local sources uploadPriority LOW 30
    • TI-2026-13285 LLB file operation can be tricked to remove /tmp directory contentsPriority LOW 16
    Show all 3 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Assisted Installer for Red Hat OpenShift Container Platform 2AffectedNo fix yet
Compliance OperatorAffectedNo fix yet
Kernel Module Management Operator for Red Hat OpenshiftAffectedNo fix yet
Migration Toolkit for ContainersAffectedNo fix yet
Multicluster Engine for KubernetesAffectedNo fix yet
Node HealthCheck OperatorAffectedNo fix yet
OpenShift LightspeedAffectedNo fix planned: Will not fix
OpenShift ServerlessAffectedNo fix planned: Will not fix
Power monitoring for Red Hat OpenShiftAffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat Certification Program for Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat OpenStack Platform 18.0AffectedNo fix yet
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Quay 3AffectedNo fix yet
Red Hat Trusted Artifact SignerAffectedNo fix yet
Red Hat Web TerminalAffectedNo fix yet
Logging Subsystem for Red Hat OpenShift 6.2Fixed RHSA-2026:68349
Logging Subsystem for Red Hat OpenShift 6.6Fixed RHSA-2026:66521
OpenShift API for Data Protection 1.5Fixed RHSA-2026:66022
Red Hat Hardened ImagesFixed RHSA-2026:43122, RHSA-2026:44152, RHSA-2026:46988
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734
Red Hat Quay 3.10Fixed RHSA-2026:66084
Red Hat Quay 3.12Fixed RHSA-2026:66523
Red Hat Quay 3.14Fixed RHSA-2026:70267
Red Hat Quay 3.16Fixed RHSA-2026:69255
Red Hat Quay 3.17Fixed RHSA-2026:74511
Red Hat Quay 3.18Fixed RHSA-2026:81110
Red Hat Quay 3.9Fixed RHSA-2026:65514
Not affected: 36 products
  • Assisted Installer for Red Hat OpenShift Container Platform 2
  • Confidential Compute Attestation
  • Logging Subsystem for Red Hat OpenShift 6.2
  • Logging Subsystem for Red Hat OpenShift 6.6
  • Logical Volume Manager Storage
  • Migration Toolkit for Applications 8
  • Migration Toolkit for Virtualization
  • Multicluster Engine for Kubernetes
  • OpenShift API for Data Protection 1.5
  • OpenShift Developer Tools and Services
  • OpenShift Serverless
  • OpenShift Service Mesh 3
  • OpenShift Source-to-Image (S2I)
  • Pen Drive Powered by Red Hat Lightspeed
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Ansible Automation Platform 2
  • Red Hat Build of Kueue
  • Red Hat Developer Hub 1
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift GitOps
  • Red Hat OpenShift Virtualization 4
  • Red Hat Openshift Data Foundation 4
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.14
  • Red Hat Quay 3.16
  • Red Hat Quay 3.17
  • Red Hat Quay 3.18
  • Red Hat Quay 3.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-15792
  2. 2026-10-07 Affected versions changed · Red Hat
  3. 2026-10-13 Fix available: RHSA-2026:81110 · Red Hat
  4. 2026-10-13 Fix available: Red Hat Quay 3.18 · Red Hat
  5. 2026-10-16 Affected versions changed · Red Hat
  6. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  7. 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  8. 2026-10-23 Affected versions changed · Red Hat
  9. 2026-10-27 Affected versions changed · Red Hat
  10. 2026-10-30 Affected versions changed · Red Hat

References

Advisory 1

  • TI-2026-14229 Tar extraction in moby/go-archive can write outside the destination directory via link following CVSS 4.0HIGH 7.1
  • TI-2021-12512 Moby HyperKit uninitialized memory use in virtio-sock pci_vtsock_proc_tx CVSS 3.1HIGH 7.1
  • TI-2024-27462 Moby authz zero length regression CVSS 3.1CRITICAL 10.0
  • TI-2024-15672 BuildKit interactive containers API does not validate entitlements check CVSS 3.1CRITICAL 9.8
  • TI-2024-15671 BuildKit possible host system access from mount stub cleaner CVSS 3.1CRITICAL 10.0
  • TI-2026-26365 Moby: AuthZ plugin bypass with oversized request body CVSS 3.1HIGH 8.8
See all 57 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences