Vulnerability-Lookup

RHSA-2026:95611

Vulnerability from csaf_redhat - Published: 2026-11-05 17:54 - Updated: 2026-11-06 13:57

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Severity

Important

Notes

Topic: An update for Red Hat Hardened Images RPMs is now available.

Details: This update includes the following RPMs: podman: * podman-5:6.1.4-1.3.hum1 (aarch64, s390x, x86_64) * podman-docker-5:6.1.4-1.3.hum1 (noarch) * podman-machine-5:6.1.4-1.3.hum1 (aarch64, x86_64) * podman-remote-5:6.1.4-1.3.hum1 (aarch64, s390x, x86_64) * podmansh-5:6.1.4-1.3.hum1 (aarch64, s390x, x86_64) * podman-5:6.1.4-1.3.hum1.src (src) Security Fix(es): podman: * CVE-2026-121522 * CVE-2026-121520

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-121520

A flaw was found in BuildKit. A client with access to the BuildKit control application programming interface (API) can submit a specially crafted build request to set extended attributes—additional metadata stored with files—on files located outside the BuildKit state directory. Manipulating these security-sensitive attributes on the host could allow an attacker to achieve privilege escalation on the underlying system.

7.9 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory

Affected products

Fixed 15 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@s390x	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-aarch64-rpms	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-s390x-rpms	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-x86_64-rpms	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:podman-machine-5:6.1.4-1.3.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:podman-machine-5:6.1.4-1.3.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:podman-remote-5:6.1.4-1.3.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:podman-remote-5:6.1.4-1.3.hum1@s390x	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:podman-remote-5:6.1.4-1.3.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:podmansh-5:6.1.4-1.3.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:podmansh-5:6.1.4-1.3.hum1@s390x	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:podmansh-5:6.1.4-1.3.hum1@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-121522

A flaw was found in BuildKit. An attacker who provides a crafted build definition can cause a Denial of Service (DoS) by crashing the BuildKit daemon. This issue occurs when a build definition resolves metadata for the same Git source reference multiple times, triggering an unhandled panic. Consequently, the daemon stops unexpectedly, interrupting all active build operations.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-248 - Uncaught Exception

Affected products

Fixed 15 products, the same list as for CVE-2026-121520

Threats

Impact Moderate

References

16 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:95611	self
https://access.redhat.com/security/cve/CVE-2026-121520	external
https://access.redhat.com/security/cve/CVE-2026-121522	external
https://access.redhat.com/security/updates/classi…	external
https://images.redhat.com/	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-121520	self
https://bugzilla.redhat.com/show_bug.cgi?id=2566567	external
https://www.cve.org/CVERecord?id=CVE-2026-121520	external
https://nvd.nist.gov/vuln/detail/CVE-2026-121520	external
https://github.com/moby/buildkit/security/advisor…	external
https://access.redhat.com/security/cve/CVE-2026-121522	self
https://bugzilla.redhat.com/show_bug.cgi?id=2566562	external
https://www.cve.org/CVERecord?id=CVE-2026-121522	external
https://nvd.nist.gov/vuln/detail/CVE-2026-121522	external
https://github.com/moby/buildkit/security/advisor…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\npodman:\n  * podman-5:6.1.4-1.3.hum1 (aarch64, s390x, x86_64)\n  * podman-docker-5:6.1.4-1.3.hum1 (noarch)\n  * podman-machine-5:6.1.4-1.3.hum1 (aarch64, x86_64)\n  * podman-remote-5:6.1.4-1.3.hum1 (aarch64, s390x, x86_64)\n  * podmansh-5:6.1.4-1.3.hum1 (aarch64, s390x, x86_64)\n  * podman-5:6.1.4-1.3.hum1.src (src)\n\nSecurity Fix(es):\n\npodman:\n  * CVE-2026-121522\n  * CVE-2026-121520",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:95611",
        "url": "https://access.redhat.com/errata/RHSA-2026:95611"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-121520",
        "url": "https://access.redhat.com/security/cve/CVE-2026-121520"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-121522",
        "url": "https://access.redhat.com/security/cve/CVE-2026-121522"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_95611.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-11-06T13:57:50+00:00",
      "generator": {
        "date": "2026-11-06T13:57:50+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.5"
        }
      },
      "id": "RHSA-2026:95611",
      "initial_release_date": "2026-11-05T17:54:41+00:00",
      "revision_history": [
        {
          "date": "2026-11-05T17:54:41+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-11-05T17:57:35+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-06T13:57:50+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "podman-5:6.1.4-1.3.hum1@aarch64",
                "product": {
                  "name": "podman-5:6.1.4-1.3.hum1@aarch64",
                  "product_id": "podman-5:6.1.4-1.3.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/podman@6.1.4-1.3.hum1?arch=aarch64\u0026epoch=5\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "podman-machine-5:6.1.4-1.3.hum1@aarch64",
                "product": {
                  "name": "podman-machine-5:6.1.4-1.3.hum1@aarch64",
                  "product_id": "podman-machine-5:6.1.4-1.3.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/podman-machine@6.1.4-1.3.hum1?arch=aarch64\u0026epoch=5\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "podman-remote-5:6.1.4-1.3.hum1@aarch64",
                "product": {
                  "name": "podman-remote-5:6.1.4-1.3.hum1@aarch64",
                  "product_id": "podman-remote-5:6.1.4-1.3.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/podman-remote@6.1.4-1.3.hum1?arch=aarch64\u0026epoch=5\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "podmansh-5:6.1.4-1.3.hum1@aarch64",
                "product": {
                  "name": "podmansh-5:6.1.4-1.3.hum1@aarch64",
                  "product_id": "podmansh-5:6.1.4-1.3.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/podmansh@6.1.4-1.3.hum1?arch=aarch64\u0026epoch=5\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "podman-5:6.1.4-1.3.hum1@s390x",
                "product": {
                  "name": "podman-5:6.1.4-1.3.hum1@s390x",
                  "product_id": "podman-5:6.1.4-1.3.hum1@s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/podman@6.1.4-1.3.hum1?arch=s390x\u0026epoch=5\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "podman-remote-5:6.1.4-1.3.hum1@s390x",
                "product": {
                  "name": "podman-remote-5:6.1.4-1.3.hum1@s390x",
                  "product_id": "podman-remote-5:6.1.4-1.3.hum1@s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/podman-remote@6.1.4-1.3.hum1?arch=s390x\u0026epoch=5\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "podmansh-5:6.1.4-1.3.hum1@s390x",
                "product": {
                  "name": "podmansh-5:6.1.4-1.3.hum1@s390x",
                  "product_id": "podmansh-5:6.1.4-1.3.hum1@s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/podmansh@6.1.4-1.3.hum1?arch=s390x\u0026epoch=5\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "podman-5:6.1.4-1.3.hum1@src",
                "product": {
                  "name": "podman-5:6.1.4-1.3.hum1@src",
                  "product_id": "podman-5:6.1.4-1.3.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/podman@6.1.4-1.3.hum1?arch=src\u0026epoch=5\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "podman-5:6.1.4-1.3.hum1@x86_64",
                "product": {
                  "name": "podman-5:6.1.4-1.3.hum1@x86_64",
                  "product_id": "podman-5:6.1.4-1.3.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/podman@6.1.4-1.3.hum1?arch=x86_64\u0026epoch=5\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "podman-machine-5:6.1.4-1.3.hum1@x86_64",
                "product": {
                  "name": "podman-machine-5:6.1.4-1.3.hum1@x86_64",
                  "product_id": "podman-machine-5:6.1.4-1.3.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/podman-machine@6.1.4-1.3.hum1?arch=x86_64\u0026epoch=5\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "podman-remote-5:6.1.4-1.3.hum1@x86_64",
                "product": {
                  "name": "podman-remote-5:6.1.4-1.3.hum1@x86_64",
                  "product_id": "podman-remote-5:6.1.4-1.3.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/podman-remote@6.1.4-1.3.hum1?arch=x86_64\u0026epoch=5\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "podmansh-5:6.1.4-1.3.hum1@x86_64",
                "product": {
                  "name": "podmansh-5:6.1.4-1.3.hum1@x86_64",
                  "product_id": "podmansh-5:6.1.4-1.3.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/podmansh@6.1.4-1.3.hum1?arch=x86_64\u0026epoch=5\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/podman-docker@6.1.4-1.3.hum1?arch=noarch\u0026epoch=5\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-s390x-rpms",
                "product": {
                  "name": "podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-s390x-rpms",
                  "product_id": "podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-s390x-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/podman-docker@6.1.4-1.3.hum1?arch=noarch\u0026epoch=5\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/podman-docker@6.1.4-1.3.hum1?arch=noarch\u0026epoch=5\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-5:6.1.4-1.3.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@aarch64"
        },
        "product_reference": "podman-5:6.1.4-1.3.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-5:6.1.4-1.3.hum1@s390x as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@s390x"
        },
        "product_reference": "podman-5:6.1.4-1.3.hum1@s390x",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-5:6.1.4-1.3.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@src"
        },
        "product_reference": "podman-5:6.1.4-1.3.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-5:6.1.4-1.3.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@x86_64"
        },
        "product_reference": "podman-5:6.1.4-1.3.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-s390x-rpms"
        },
        "product_reference": "podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-s390x-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-machine-5:6.1.4-1.3.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:podman-machine-5:6.1.4-1.3.hum1@aarch64"
        },
        "product_reference": "podman-machine-5:6.1.4-1.3.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-machine-5:6.1.4-1.3.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:podman-machine-5:6.1.4-1.3.hum1@x86_64"
        },
        "product_reference": "podman-machine-5:6.1.4-1.3.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-5:6.1.4-1.3.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:podman-remote-5:6.1.4-1.3.hum1@aarch64"
        },
        "product_reference": "podman-remote-5:6.1.4-1.3.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-5:6.1.4-1.3.hum1@s390x as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:podman-remote-5:6.1.4-1.3.hum1@s390x"
        },
        "product_reference": "podman-remote-5:6.1.4-1.3.hum1@s390x",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-5:6.1.4-1.3.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:podman-remote-5:6.1.4-1.3.hum1@x86_64"
        },
        "product_reference": "podman-remote-5:6.1.4-1.3.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podmansh-5:6.1.4-1.3.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:podmansh-5:6.1.4-1.3.hum1@aarch64"
        },
        "product_reference": "podmansh-5:6.1.4-1.3.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podmansh-5:6.1.4-1.3.hum1@s390x as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:podmansh-5:6.1.4-1.3.hum1@s390x"
        },
        "product_reference": "podmansh-5:6.1.4-1.3.hum1@s390x",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podmansh-5:6.1.4-1.3.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:podmansh-5:6.1.4-1.3.hum1@x86_64"
        },
        "product_reference": "podmansh-5:6.1.4-1.3.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-121520",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory"
      },
      "discovery_date": "2026-11-03T22:22:50.186115+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2566567"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in BuildKit. A client with access to the BuildKit control application programming interface (API) can submit a specially crafted build request to set extended attributes\u2014additional metadata stored with files\u2014on files located outside the BuildKit state directory. Manipulating these security-sensitive attributes on the host could allow an attacker to achieve privilege escalation on the underlying system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/moby/buildkit: BuildKit: Privilege escalation via unauthorized extended file attribute modification",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has evaluated this vulnerability as Important because an attacker capable of dispatching build workloads can alter sensitive file metadata outside the working directory, enabling privilege escalation on the underlying host. The greatest impact occurs in multi-tenant environments, such as shared OpenShift build services where arbitrary or untrusted users are permitted to trigger container image builds. Systems where build execution is restricted to trusted operators or dedicated single-user workstations experience minimal exposure, as users typically already hold administrative control over their local environments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@aarch64",
          "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@s390x",
          "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@src",
          "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@x86_64",
          "Red Hat Hardened Images:podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:podman-machine-5:6.1.4-1.3.hum1@aarch64",
          "Red Hat Hardened Images:podman-machine-5:6.1.4-1.3.hum1@x86_64",
          "Red Hat Hardened Images:podman-remote-5:6.1.4-1.3.hum1@aarch64",
          "Red Hat Hardened Images:podman-remote-5:6.1.4-1.3.hum1@s390x",
          "Red Hat Hardened Images:podman-remote-5:6.1.4-1.3.hum1@x86_64",
          "Red Hat Hardened Images:podmansh-5:6.1.4-1.3.hum1@aarch64",
          "Red Hat Hardened Images:podmansh-5:6.1.4-1.3.hum1@s390x",
          "Red Hat Hardened Images:podmansh-5:6.1.4-1.3.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-121520"
        },
        {
          "category": "external",
          "summary": "RHBZ#2566567",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2566567"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-121520",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-121520"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-121520",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121520"
        },
        {
          "category": "external",
          "summary": "https://github.com/moby/buildkit/security/advisories/GHSA-w26x-xg27-7qjc",
          "url": "https://github.com/moby/buildkit/security/advisories/GHSA-w26x-xg27-7qjc"
        }
      ],
      "release_date": "2026-11-03T22:11:57.202000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-05T17:54:41+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@aarch64",
            "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@s390x",
            "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@src",
            "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@x86_64",
            "Red Hat Hardened Images:podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:podman-machine-5:6.1.4-1.3.hum1@aarch64",
            "Red Hat Hardened Images:podman-machine-5:6.1.4-1.3.hum1@x86_64",
            "Red Hat Hardened Images:podman-remote-5:6.1.4-1.3.hum1@aarch64",
            "Red Hat Hardened Images:podman-remote-5:6.1.4-1.3.hum1@s390x",
            "Red Hat Hardened Images:podman-remote-5:6.1.4-1.3.hum1@x86_64",
            "Red Hat Hardened Images:podmansh-5:6.1.4-1.3.hum1@aarch64",
            "Red Hat Hardened Images:podmansh-5:6.1.4-1.3.hum1@s390x",
            "Red Hat Hardened Images:podmansh-5:6.1.4-1.3.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95611"
        },
        {
          "category": "workaround",
          "details": "Restrict access to the BuildKit control API socket and network endpoints to trusted administrative operators using strict file system permissions and mutual TLS. In multi-tenant environments, isolate build execution within dedicated, ephemeral virtual machines rather than sharing the daemon across untrusted tenants.\n\n--- CME Mitigation Guidance (2026-11-04) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to confine all extended attribute modifications within BuildKit strictly to the internal state directory and prevent following symlinks outside the build boundary: upgrade to BuildKit v0.34.1 (or the corresponding fixed Red Hat builds), which restrict extended attribute modifications to the BuildKit state directory and prevent following links outside the build boundary, closing all 3 injection vectors (crafted build request submitting xattrs targeting paths outside the state directory, symbolic link traversal targeting host files for extended attribute modification, manipulation of security and trusted namespace extended attributes). Until patched, this is only a concern on Linux build hosts and multi-tenant build services accepting BuildKit control API requests \u2014 Non-Linux platforms are unaffected \u2014 so Restrict access to the BuildKit control API socket and network endpoints to trusted operators using strict permissions and mutual TLS, or isolate builds in dedicated ephemeral virtual machines. As a compensating measure, Log setxattr and lsetxattr syscalls targeting sensitive host directories and security namespaces using auditd, Enforce SELinux mandatory access controls to confine the BuildKit daemon from modifying host extended attributes outside its domain, Restrict the BuildKit process filesystem sandbox to explicitly allowed directory hierarchies using Landlock LSM, Use mount and user namespaces to isolate the daemon filesystem view from host extended attribute modifications, Run BuildKit in rootless mode to prevent setting privileged security and trusted namespace extended attributes on the host filesystem, and Drop CAP_SYS_ADMIN and CAP_SETFCAP from the BuildKit daemon to prevent setting sensitive extended attributes. These controls limit blast radius and contain exploitation, but they do not fix the underlying path traversal and symlink following defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1301 Path Traversal Prevention (Canonicalization) (high)",
          "product_ids": [
            "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@aarch64",
            "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@s390x",
            "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@src",
            "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@x86_64",
            "Red Hat Hardened Images:podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:podman-machine-5:6.1.4-1.3.hum1@aarch64",
            "Red Hat Hardened Images:podman-machine-5:6.1.4-1.3.hum1@x86_64",
            "Red Hat Hardened Images:podman-remote-5:6.1.4-1.3.hum1@aarch64",
            "Red Hat Hardened Images:podman-remote-5:6.1.4-1.3.hum1@s390x",
            "Red Hat Hardened Images:podman-remote-5:6.1.4-1.3.hum1@x86_64",
            "Red Hat Hardened Images:podmansh-5:6.1.4-1.3.hum1@aarch64",
            "Red Hat Hardened Images:podmansh-5:6.1.4-1.3.hum1@s390x",
            "Red Hat Hardened Images:podmansh-5:6.1.4-1.3.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.9,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@aarch64",
            "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@s390x",
            "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@src",
            "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@x86_64",
            "Red Hat Hardened Images:podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:podman-machine-5:6.1.4-1.3.hum1@aarch64",
            "Red Hat Hardened Images:podman-machine-5:6.1.4-1.3.hum1@x86_64",
            "Red Hat Hardened Images:podman-remote-5:6.1.4-1.3.hum1@aarch64",
            "Red Hat Hardened Images:podman-remote-5:6.1.4-1.3.hum1@s390x",
            "Red Hat Hardened Images:podman-remote-5:6.1.4-1.3.hum1@x86_64",
            "Red Hat Hardened Images:podmansh-5:6.1.4-1.3.hum1@aarch64",
            "Red Hat Hardened Images:podmansh-5:6.1.4-1.3.hum1@s390x",
            "Red Hat Hardened Images:podmansh-5:6.1.4-1.3.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/moby/buildkit: BuildKit: Privilege escalation via unauthorized extended file attribute modification"
    },
    {
      "cve": "CVE-2026-121522",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-11-03T22:22:22.067545+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2566562"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in BuildKit. An attacker who provides a crafted build definition can cause a Denial of Service (DoS) by crashing the BuildKit daemon. This issue occurs when a build definition resolves metadata for the same Git source reference multiple times, triggering an unhandled panic. Consequently, the daemon stops unexpectedly, interrupting all active build operations.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/moby/buildkit: BuildKit: Denial of Service via duplicate Git source metadata resolution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in BuildKit\u0027s Git source reference resolution logic. When processing a crafted build definition that resolves metadata for the same Git source reference multiple times, an unhandled panic is triggered, crashing the BuildKit daemon and resulting in a denial of service to all active build operations.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@aarch64",
          "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@s390x",
          "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@src",
          "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@x86_64",
          "Red Hat Hardened Images:podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:podman-machine-5:6.1.4-1.3.hum1@aarch64",
          "Red Hat Hardened Images:podman-machine-5:6.1.4-1.3.hum1@x86_64",
          "Red Hat Hardened Images:podman-remote-5:6.1.4-1.3.hum1@aarch64",
          "Red Hat Hardened Images:podman-remote-5:6.1.4-1.3.hum1@s390x",
          "Red Hat Hardened Images:podman-remote-5:6.1.4-1.3.hum1@x86_64",
          "Red Hat Hardened Images:podmansh-5:6.1.4-1.3.hum1@aarch64",
          "Red Hat Hardened Images:podmansh-5:6.1.4-1.3.hum1@s390x",
          "Red Hat Hardened Images:podmansh-5:6.1.4-1.3.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-121522"
        },
        {
          "category": "external",
          "summary": "RHBZ#2566562",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2566562"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-121522",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-121522"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-121522",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121522"
        },
        {
          "category": "external",
          "summary": "https://github.com/moby/buildkit/security/advisories/GHSA-2fqp-xg6f-v7gj",
          "url": "https://github.com/moby/buildkit/security/advisories/GHSA-2fqp-xg6f-v7gj"
        }
      ],
      "release_date": "2026-11-03T22:09:29.028000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-05T17:54:41+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@aarch64",
            "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@s390x",
            "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@src",
            "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@x86_64",
            "Red Hat Hardened Images:podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:podman-machine-5:6.1.4-1.3.hum1@aarch64",
            "Red Hat Hardened Images:podman-machine-5:6.1.4-1.3.hum1@x86_64",
            "Red Hat Hardened Images:podman-remote-5:6.1.4-1.3.hum1@aarch64",
            "Red Hat Hardened Images:podman-remote-5:6.1.4-1.3.hum1@s390x",
            "Red Hat Hardened Images:podman-remote-5:6.1.4-1.3.hum1@x86_64",
            "Red Hat Hardened Images:podmansh-5:6.1.4-1.3.hum1@aarch64",
            "Red Hat Hardened Images:podmansh-5:6.1.4-1.3.hum1@s390x",
            "Red Hat Hardened Images:podmansh-5:6.1.4-1.3.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:95611"
        },
        {
          "category": "workaround",
          "details": "Restrict build submission permissions to trusted users and avoid building untrusted definitions or repositories on shared daemon instances. In multi-tenant environments, isolate BuildKit daemon instances per workload to prevent daemon-level crashes from impacting concurrent builds.",
          "product_ids": [
            "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@aarch64",
            "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@s390x",
            "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@src",
            "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@x86_64",
            "Red Hat Hardened Images:podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:podman-machine-5:6.1.4-1.3.hum1@aarch64",
            "Red Hat Hardened Images:podman-machine-5:6.1.4-1.3.hum1@x86_64",
            "Red Hat Hardened Images:podman-remote-5:6.1.4-1.3.hum1@aarch64",
            "Red Hat Hardened Images:podman-remote-5:6.1.4-1.3.hum1@s390x",
            "Red Hat Hardened Images:podman-remote-5:6.1.4-1.3.hum1@x86_64",
            "Red Hat Hardened Images:podmansh-5:6.1.4-1.3.hum1@aarch64",
            "Red Hat Hardened Images:podmansh-5:6.1.4-1.3.hum1@s390x",
            "Red Hat Hardened Images:podmansh-5:6.1.4-1.3.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@aarch64",
            "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@s390x",
            "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@src",
            "Red Hat Hardened Images:podman-5:6.1.4-1.3.hum1@x86_64",
            "Red Hat Hardened Images:podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:podman-docker-5:6.1.4-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:podman-machine-5:6.1.4-1.3.hum1@aarch64",
            "Red Hat Hardened Images:podman-machine-5:6.1.4-1.3.hum1@x86_64",
            "Red Hat Hardened Images:podman-remote-5:6.1.4-1.3.hum1@aarch64",
            "Red Hat Hardened Images:podman-remote-5:6.1.4-1.3.hum1@s390x",
            "Red Hat Hardened Images:podman-remote-5:6.1.4-1.3.hum1@x86_64",
            "Red Hat Hardened Images:podmansh-5:6.1.4-1.3.hum1@aarch64",
            "Red Hat Hardened Images:podmansh-5:6.1.4-1.3.hum1@s390x",
            "Red Hat Hardened Images:podmansh-5:6.1.4-1.3.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "github.com/moby/buildkit: BuildKit: Denial of Service via duplicate Git source metadata resolution"
    }
  ]
}

CVE-2026-121520 (GCVE-0-2026-121520)

Vulnerability from cvelistv5 – Published: 2026-11-03 22:11 – Updated: 2026-11-06 19:31

Title

Malicious client could set xattr value outside of BuildKit state directory

Summary

In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.

Severity

4.5 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 19:30 UTC

CWE

CWE-61 - UNIX Symbolic Link (Symlink) Following

Assigner

Docker CNA under the mitre root

CNA scorecard B 88/100 over 42 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/moby/buildkit/security/advisor…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Moby	BuildKit	Affected: 0 , < 0.34.1 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-121520",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T19:30:46.298631Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T19:31:00.151Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BuildKit",
          "repo": "https://github.com/moby/buildkit",
          "vendor": "Moby",
          "versions": [
            {
              "lessThan": "0.34.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 4.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "Host security-label modification"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-61",
              "description": "CWE-61: UNIX Symbolic Link (Symlink) Following",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T22:11:57.202Z",
        "orgId": "686469e6-3ff6-451b-ab8b-cf5b9e89401e",
        "shortName": "Docker"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/moby/buildkit/security/advisories/GHSA-w26x-xg27-7qjc"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade BuildKit to v0.34.1 or later."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Malicious client could set xattr value outside of BuildKit state directory",
      "workarounds": [
        {
          "lang": "en",
          "value": "Restrict access to BuildKit control APIs to trusted clients and do not accept build requests from untrusted users."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "686469e6-3ff6-451b-ab8b-cf5b9e89401e",
    "assignerShortName": "Docker",
    "cveId": "CVE-2026-121520",
    "datePublished": "2026-11-03T22:11:57.202Z",
    "dateReserved": "2026-11-03T14:26:45.909Z",
    "dateUpdated": "2026-11-06T19:31:00.151Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-121522 (GCVE-0-2026-121522)

Vulnerability from cvelistv5 – Published: 2026-11-03 22:09 – Updated: 2026-11-06 19:31

Title

Possible panic from Git source resolver

Summary

In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2.

Severity

6.7 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 19:31 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

Docker CNA under the mitre root

CNA scorecard B 88/100 over 42 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/moby/buildkit/security/advisor…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
moby	BuildKit	Affected: 0.26.0 , < 0.34.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-121522",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T19:31:23.734747Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T19:31:52.954Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "github.com/moby/buildkit",
          "product": "BuildKit",
          "vendor": "moby",
          "versions": [
            {
              "lessThan": "0.34.2",
              "status": "affected",
              "version": "0.26.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "Attacker-controlled build input processed by a user"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476: NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T22:09:29.028Z",
        "orgId": "686469e6-3ff6-451b-ab8b-cf5b9e89401e",
        "shortName": "Docker"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/moby/buildkit/security/advisories/GHSA-2fqp-xg6f-v7gj"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade BuildKit to v0.34.2 or later."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Possible panic from Git source resolver",
      "workarounds": [
        {
          "lang": "en",
          "value": "Avoid untrusted build definitions. Only specific builds using Git dependencies trigger this issue."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "686469e6-3ff6-451b-ab8b-cf5b9e89401e",
    "assignerShortName": "Docker",
    "cveId": "CVE-2026-121522",
    "datePublished": "2026-11-03T22:09:29.028Z",
    "dateReserved": "2026-11-03T14:27:34.585Z",
    "dateUpdated": "2026-11-06T19:31:52.954Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:95611

CVE-2026-121520 (GCVE-0-2026-121520)

CVE-2026-121522 (GCVE-0-2026-121522)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour