CVE-2026-75593

A flaw was found in BuildKit, a toolkit for converting source code to build artifacts. A malicious client with valid permissions to access the BuildKit control API can craft a special upload request. This request allows files to escape from the BuildKit-controlled state directory, potentially leading to unauthorized modification or deletion of files on the system.

A flaw in BuildKit allows a client with valid permissions to the BuildKit control API to perform unauthorized file modifications outside the intended build state directory. This issue is limited to authenticated clients, reducing the overall attack surface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict access to the BuildKit control API to only trusted users and services. Implement robust authentication and authorization policies for all clients interacting with the BuildKit daemon to prevent unauthorized access and potential file system escapes.