PT-2026-61699

CVE-2026-15788

Published

2026-07-20

Updated

2026-08-05

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions BuildKit (affected versions not specified)

Description On Windows Container on Windows (WCOW) workers, the cache mount source= selector fails to detect NTFS directory junctions located within the cache root. This allows an untrusted user to author a build that can read arbitrary host files accessible to the BuildKit daemon process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Junyi Liu

Vendors

Affected products

Weakness enumeration

CWE-59: Improper Link Resolution Before File Access (\'Link Following\')

Related identifiers

CVE-2026-15788