Skip to content
VulniPulse
Sign in
Highest advisory severityHigh 2 vendors · 2 advisories

CVE-2026-33748

CVE-2026-33748: 2 tracked advisory records across Docker, Red Hat. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Docker

1 advisory
  • Advisory severityHigh8.2

    High [CVE-2026-33748] BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner

    CVE-2026-33748Source published Source updated

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem. The issue has been fixed in version v0.28.1 The issue affects only builds that use Git URLs with a subpath component. As a workaround, avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.

    Related products — impact not confirmed
    • BuildKit
    Source-reported affected versions
    • before 0.28.1
    Source-reported fixed versions
    • 0.28.1
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Full advisory and evidenceOpen source bulletin

Red Hat

1 advisory
  • Advisory severityMedium6.5

    Medium [CVE-2026-33748] Unauthorized file access via Git URL fragment subdir components

    CVE-2026-33748Source published

    Unauthorized file access via Git URL fragment subdir components. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-22. Affected package(s): openshift-service-mesh/istio-proxyv2-rhel9:1776240392, multicluster-engine/must-gather-rhel9:1782158798, openshift-service-mesh/istio-proxyv2-rhel9:1776291540, openshift-service-mesh/istio-proxyv2-rhel9:1776315466, oadp/oadp-mustgather-rhel9:1779770049, oadp/oadp-mustgather-rhel9:1779770057. Resolved in Red Hat advisory RHSA-2026:9453 — update the affected packages (`sudo dnf update`).

    Related products — impact not confirmed
    • openshift-service-mesh/istio-proxyv2-rhel9:1776240392
    • multicluster-engine/must-gather-rhel9:1782158798
    • openshift-service-mesh/istio-proxyv2-rhel9:1776291540
    • openshift-service-mesh/istio-proxyv2-rhel9:1776315466

    3 more entries in the full advisory.

    Source-reported affected versions
    • openshift-service-mesh/istio-proxyv2-rhel9:1776240392
    • multicluster-engine/must-gather-rhel9:1782158798
    • openshift-service-mesh/istio-proxyv2-rhel9:1776291540
    • openshift-service-mesh/istio-proxyv2-rhel9:1776315466

    3 more entries in the full advisory.

    Source-reported fixed versions
    • RHSA-2026:9453
    Mitigation guidance
    • Update the affected package(s) to the fixed version shipped in RHSA-2026:9453 (`sudo dnf update` / `yum update`).
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features