CVE-2026-44517: Buildah Path Traversal Vulnerability

CVE-2026-44517 Overview

CVE-2026-44517 is a path traversal vulnerability in Buildah, a tool for building Open Container Initiative (OCI) images. The flaw exists in TempDirForURL within define/types.go, which does not confine Git repository subdirectories to the downloaded build context. Additionally, downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left by a partially extracted tar archive. A malicious server providing a Git repository or tar archive can cause files outside the build context to be pulled into the image. The issue affects Buildah from version 1.38.1 through 1.43.1 and 1.44.0-pre releases, and is tracked under CWE-22.

Critical Impact
A malicious remote build source can force Buildah to read arbitrary files from the local filesystem and include them in the resulting OCI image, leading to sensitive data exposure.

Affected Products

Buildah versions 1.38.1 through 1.43.1
Buildah 1.44.0 pre-release builds
Container build pipelines and CI/CD systems consuming untrusted Git or tar sources with Buildah

Discovery Timeline

2026-08-21 - CVE-2026-44517 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-44517

Vulnerability Analysis

Buildah retrieves build contexts from remote sources including Git repositories, HTTP URLs, tar archives, and standard input. The TempDirForURL function in define/types.go handles downloading and extracting these sources into a temporary directory that acts as the build context. The vulnerability arises because the routine does not securely join paths when resolving Git repository subdirectories, and sibling functions downloadToDirectory and stdinToDirectory process tar archives without validating symlinks encountered during extraction.

An attacker who controls the remote Git repository or tar archive can craft entries that resolve to paths outside the intended build context. When Buildah subsequently reads the Dockerfile or copies files during the build, it follows these symlinks and includes attacker-selected files from the host into the image. This is a classic symlink traversal that occurs during a two-stage extract-then-read workflow.

Root Cause

The underlying defect is missing secure path joining and missing symlink validation between tar extraction and Dockerfile resolution. The fix introduces the filepath-securejoin library from github.com/cyphar/filepath-securejoin and refactors URL source handling into a new internal/urlsource package that enforces containment inside the build context directory.

Attack Vector

Exploitation requires user interaction: a victim must invoke buildah against an attacker-controlled Git URL or pipe a malicious tar archive into the build. The attack vector is local because Buildah must be executed on the target host, but the malicious content originates from a remote source. Successful exploitation yields confidentiality impact through disclosure of files readable by the user running Buildah.

// Security patch in define/types.go
// Source: https://github.com/podman-container-tools/buildah/commit/54459cf8a0feb4b1da766e4a6360451834e1846c

 	"path/filepath"
 	"strings"

+	securejoin "github.com/cyphar/filepath-securejoin"
 	v1 "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/sirupsen/logrus"
+	"go.podman.io/buildah/internal/urlsource"
 	"go.podman.io/image/v5/manifest"
 	"go.podman.io/storage/pkg/archive"
 	"go.podman.io/storage/pkg/chrootarchive"
-	"go.podman.io/storage/pkg/ioutils"
 	"go.podman.io/storage/types"
 )

The patch replaces the previous ioutils helper with securejoin for path resolution and centralizes URL fetching in internal/urlsource so all remote-source handlers enforce the same containment guarantees.

Detection Methods for CVE-2026-44517

Indicators of Compromise

Buildah invocations against Git URLs or tar archives from untrusted origins in shell history or CI job logs
Presence of absolute-path or .. symlinks inside downloaded build contexts under temporary directories used by Buildah
Unexpected files such as /etc/shadow, SSH keys, or cloud credentials embedded in resulting OCI image layers

Detection Strategies

Inspect final container images for files that were not present in the original source repository, especially sensitive host paths outside the declared COPY sources
Audit CI/CD pipeline logs for buildah bud or buildah build commands referencing external Git URLs and correlate with the installed Buildah version
Scan Buildah temporary directories during builds for symlinks whose targets resolve outside the build context root

Monitoring Recommendations

Log Buildah process invocations along with the resolved source URL and Buildah version to identify vulnerable hosts
Track image layer manifests for unexpected file paths that indicate traversal outside the intended context
Alert on outbound Git or HTTP requests from build hosts to domains not on an approved source list

How to Mitigate CVE-2026-44517

Immediate Actions Required

Upgrade Buildah to version 1.43.2 on the 1.43.x branch or to version 1.44.0 on the 1.44.x branch
Restrict Buildah execution to trusted build sources until upgrades are applied across all build hosts
Rotate any credentials, keys, or secrets that may have been exposed on hosts that built untrusted Git or tar sources

Patch Information

The fix is available in Buildah v1.43.2 and v1.44.0. The relevant commits are 54459cf and fc2003b. Full details are documented in GHSA-49p4-px3h-rq49.

Workarounds

Only build from Git repositories and tar archives sourced from trusted, authenticated origins
Run Buildah inside an unprivileged, minimally scoped user namespace so that traversal targets do not include sensitive host files
Pre-clone Git repositories with a hardened client and validate contents before passing a local path to Buildah

bash

# Verify installed Buildah version and upgrade
buildah --version

# Fedora / RHEL
sudo dnf upgrade buildah

# Debian / Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade buildah

# Confirm remediation
buildah --version  # expect 1.43.2 or 1.44.0 or later