Buildah: Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 8 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.
Summary
Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left by a partially extracted tar archive. A malicious server supplying a Git repository or tar archive can cause files outside the build context directory to be included in the context or copied into the build. This issue is fixed in versions 1.43.2 and 1.44.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| containers | buildah | 1.38.1 to before 1.43.2 | 1.43.2 | Patch available | CNA |
| — | github.com/containers/buildah (Go) | 1.38.1 to before 1.43.2 | 1.43.2 | Patch available | GHSA-49p4-px3h-rq49 |
- buildah Vendorcontainers Affected 1.38.1 to before 1.43.2 Fixed in 1.43.2 Patch available CNA
- github.com/containers/buildah (Go) Vendor— Affected 1.38.1 to before 1.43.2 Fixed in 1.43.2 Patch available GHSA-49p4-px3h-rq49
Remediation
- Fix · CNA buildah (containers) Fixed in 1.43.2
- Fix · GHSA-49p4-px3h-rq49 github.com/containers/buildah (Go) Fixed in 1.43.2 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
Not affected: 4 products
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-44517
- 2026-10-03 Alias added: GHSA-49p4-px3h-rq49
- 2026-10-30 Affected versions changed · Red Hat
References
Other 7
- https://github.com/podman-container-tools/buildah/security/advisories/GHSA-49p4-px3h-rq49
- https://github.com/podman-container-tools/buildah/commit/54459cf8a0feb4b1da766e4a6360451834e1846c
- https://github.com/podman-container-tools/buildah/commit/fc2003bb2efeb3ed7d5c7e1e88d04e78f370a944
- https://github.com/podman-container-tools/buildah/releases/tag/v1.43.2
- https://github.com/podman-container-tools/buildah/releases/tag/v1.44.0
- https://github.com/containers/buildah/security/advisories/GHSA-49p4-px3h-rq49
- https://github.com/podman-container-tools/buildah
More containers vulnerabilities
- TI-2025-18645 .krun_config.json symlink attack creates or overwrites file on the host in crun CVSS 4.0HIGH 8.5
- TI-2026-23721 Crun incorrectly parses `crun exec` option `-u`, leading to privilege escalation CVSS 3.1HIGH 7.8
- TI-2026-37901 fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC) CVSS 4.0LOW 2.0
- TI-2026-29788 bubblewrap vulnerable to privilege escalation in setuid mode via ptrace CVSS 4.0HIGH 8.7
- TI-2024-07805 Containers/aardvark-dns: tcp query handling flaw in aardvark-dns leading to denial of service CVSS 3.1HIGH 7.5
- TI-2024-08665 Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library CVSS 3.1HIGH 8.2
Sources
- CVE-2026-44517 · CVE Program
- CVE-2026-44517 · NVD
- FIRST EPSS
- GHSA-49p4-px3h-rq49 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-44517 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences