BuildKit CVE-2026-15791

Exploitation requires: (1) local access to the BuildKit daemon's API socket or endpoint (AV:L) - the attacker must be able to submit raw low-level build API messages, not merely invoke 'docker build'; (2) a specific attack precondition is present (AT:P) - the attacker must control the build API message payload, which in practice means either being the build client, compromising it, or injecting content into a Dockerfile/build context that reaches the low-level API; (3) active user interaction (UI:A) - a build operation must be initiated or already in progress. Exploitation is limited by: the requirement for local API access (not a remote/internet-facing vector by default); the need for an active build session; and the constrained impact (host /tmp destruction only, no code execution or data exfiltration). Default Docker CLI usage does not expose the low-level API to untrusted input, so standard 'docker build' users face lower residual risk than environments exposing the BuildKit daemon API directly to less-trusted clients.

Real-world risk is low-to-moderate and well-represented by the 3.3 score. The CVSS 4.0 vector is AV:L (local attack surface - the BuildKit socket or API must be reachable), AT:P (specific precondition - control over the low-level build API message format, not merely running a normal build), UI:A (active user interaction required - a build session must be in progress or triggered), PR:N (no formal privilege level required within the API), and VC:N/VI:L/VA:L (no confidentiality loss; low integrity and availability impact). No EPSS data was provided; however, given no KEV status, no POC, and the constrained local/interactive vector, opportunistic mass exploitation is unlikely. The primary real-world scenario is a malicious or compromised build client in a CI/CD pipeline targeting the BuildKit daemon. Destroying /tmp can cause denial-of-service for processes depending on temporary files but does not grant code execution or credential access. CVSS indicates no scope-change impact on the subsequent system (host), which slightly under-represents the host /tmp data destruction - this discrepancy should be noted and verified against the vendor advisory.

An attacker with the ability to submit crafted messages to the BuildKit low-level build API - for example, a malicious CI/CD pipeline step, a compromised build tool, or a rogue build script - sends a specially constructed file-deletion instruction that embeds a path traversal sequence. When BuildKit processes the message during a build session, the deletion escapes the container rootfs mount and removes files under the host's /tmp directory, disrupting any host processes relying on temporary storage. No public POC has been identified, but the API message format is documented, lowering the conceptual barrier to exploitation for a technically skilled attacker with API access.