CVE-2026-15788 Overview
CVE-2026-15788 is a link-following vulnerability [CWE-59] in BuildKit's cache mount source= selector when running on Windows Container on Windows (WCOW) workers. The selector fails to detect NTFS directory junctions placed inside the cache root. A build authored by an untrusted user on a WCOW-configured BuildKit daemon can traverse these junctions to read arbitrary host files reachable by the BuildKit daemon process. The issue is scoped to Windows containers and requires an attacker capable of submitting a build definition to the daemon.
Critical Impact
Untrusted build definitions can escape the intended cache mount scope on Windows workers and disclose sensitive host files accessible to the BuildKit daemon.
Affected Products
- Moby BuildKit on Windows Container on Windows (WCOW) workers
- BuildKit daemons accepting builds from untrusted authors on Windows hosts
- Downstream container build tooling that embeds BuildKit for WCOW builds
Discovery Timeline
- 2026-07-20 - CVE-2026-15788 published to NVD
- 2026-07-21 - Last updated in NVD database
Technical Details for CVE-2026-15788
Vulnerability Analysis
BuildKit exposes a source= selector on cache mounts that scopes reads and writes to a subdirectory of the daemon-managed cache root. On Linux workers, the selector normalizes and validates the resolved path to prevent escape. On WCOW workers, the selector does not evaluate NTFS directory junctions created inside the cache root before resolving source=. This allows a crafted build to place a junction that points outside the cache and then reference it through the selector.
The result is a link-following flaw [CWE-59] that lets a build read files anywhere the BuildKit daemon process can reach on the host. Because BuildKit typically runs with elevated privileges on Windows to manage container storage, the reachable file set often includes configuration files, secrets, and other tenants' build artifacts.
Root Cause
The root cause is missing reparse point validation inside the source= path resolver on the Windows worker code path. The resolver treats directory entries as regular directories without inspecting NTFS reparse point attributes that mark junctions. Path normalization occurs after the junction has already been followed by the filesystem layer.
Attack Vector
Exploitation requires a local attack vector where an untrusted user can submit a build to a shared WCOW BuildKit daemon. The attacker authors a Dockerfile or LLB definition that creates a directory junction inside the cache root pointing to a target host path, then declares a cache mount with a matching source= value. Subsequent build steps read the junction target and can exfiltrate contents through image layers, build output, or logs. No network access to the daemon is required beyond the standard build submission path.
No public proof-of-concept is listed in the referenced advisory, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog. Refer to the GitHub Security Advisory GHSA-388v-wmr2-g2v2 for maintainer-provided technical detail.
Detection Methods for CVE-2026-15788
Indicators of Compromise
- Directory junctions created inside the BuildKit cache root on Windows hosts, identifiable through fsutil reparsepoint query output or dir /AL listings.
- Build outputs or image layers that contain host files not referenced by the source Dockerfile, such as contents of C:\ProgramData, C:\Users, or daemon configuration paths.
- BuildKit daemon access to files outside its expected cache and workspace directories in process telemetry.
Detection Strategies
- Inspect submitted Dockerfiles and LLB definitions for RUN steps invoking mklink /J, New-Item -ItemType Junction, or equivalent APIs that create reparse points before a cache mount is consumed.
- Enable filesystem auditing on the BuildKit cache root and alert on reparse point creation events (Windows event ID 4663 with reparse point access mask).
- Correlate BuildKit worker process file reads against declared build context paths to surface accesses that fall outside the cache and workspace scope.
Monitoring Recommendations
- Log all build submissions with author identity and retain build definitions for post-incident review on shared WCOW daemons.
- Monitor BuildKit daemon versions across Windows build hosts and alert on hosts running versions listed as affected in GHSA-388v-wmr2-g2v2.
- Track EPSS trend for CVE-2026-15788 to reprioritize patching if exploitation likelihood increases.
How to Mitigate CVE-2026-15788
Immediate Actions Required
- Upgrade BuildKit on all Windows Container on Windows workers to the fixed version identified in GHSA-388v-wmr2-g2v2.
- Restrict WCOW BuildKit daemons to trusted build authors until patching completes, and revoke access for shared or anonymous submitters.
- Audit recent builds on affected daemons for junction creation steps and unexpected file reads.
Patch Information
The Moby project has published a security advisory at GHSA-388v-wmr2-g2v2 that identifies the fixed BuildKit release for WCOW workers. Apply the patched version to every Windows build host running BuildKit and restart the daemon so the corrected source= resolver is loaded.
Workarounds
- Run BuildKit only on Linux workers until the Windows patch is deployed, since the flaw is scoped to WCOW.
- Limit build submission to trusted internal users through daemon-level authentication and network segmentation.
- Run the BuildKit daemon under a Windows service account with the minimum filesystem permissions needed for builds, reducing the set of host files reachable through a successful junction traversal.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
