Vulnerability in Moby Buildkit
CVE-2026-15793
BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host.
Affected products
- Moby Buildkit — versions 0.30.0
Weakness classification (CWE)
References
- security@docker.com (vendor-advisory)