CVE-2026-15788
CVE-2026-15788: 2 tracked advisory records across Docker, Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Docker
1 advisory- Advisory severityMedium5.6
Medium [CVE-2026-15788] BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root
CVE-2026-15788Source published Source updated
BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root. A build authored by an untrusted user on a WCOW-configured BuildKit daemon can read arbitrary host files reachable to the BuildKit daemon process.
- Affected products in this advisory
- BuildKit
- Source-reported affected versions
- BuildKit before 0.31.2
- Source-reported fixed versions
- 0.31.2
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
Red Hat
1 advisory- Advisory severityMedium6.3
Medium [CVE-2026-15788] Information Disclosure via Improper Handling of NTFS Directory Junctions
CVE-2026-15788Source published Source updated
BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root. A build authored by an untrusted user on a WCOW-configured BuildKit daemon can read arbitrary host files reachable to the BuildKit daemon process. A flaw was found in BuildKit. An untrusted user, when authoring a build on a Windows Container on Windows (WCOW) configured BuildKit daemon, can exploit a vulnerability in the cache mount source selector. Red Hat severity: Moderate — CVSS 6.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N). Weakness: CWE-22. Affected Red Hat products: Red Hat Hardened Images. Red Hat fixing advisory: RHSA-2026:43122, RHSA-2026:44152, RHSA-2026:46988, RHSA-2026:51065.
- Affected products in this advisory
- Red Hat Hardened Images
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- buildah-main-1.44.0-3.2.hum1
- podman-main-6.0.2-2.1.hum1
- trivy-main-0.72.0-0.1.2.hum1
- buildah-main-1.45.0-2.hum1
4 more entries in the full advisory.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
Android app · Google Play
Turn CVE research into alerts on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.