Executive brief
Moby BuildKit, a tool used for building container images, contains a vulnerability when running on Windows. An untrusted user can craft a build process that bypasses security boundaries to read sensitive files from the host computer. This could lead to the exposure of private data or system configuration files reachable by the BuildKit service.
Technical details
A vulnerability exists in BuildKit's cache mount 'source=' selector when used on Windows Container on Windows (WCOW) workers. The component fails to properly detect or validate NTFS directory junctions (symbolic links) placed within the cache root. An attacker providing a malicious build definition can use these junctions to point to locations outside the intended cache directory. This allows the build process to read any file on the host system that the BuildKit daemon process has permissions to access. The issue is tracked as CWE-59 and is resolved in BuildKit version 0.31.2.
Affected products
- Moby BuildKit < 0.31.2
Timeline
- 2026-07-16: advisory: GitHub Security Advisory published by Moby project
- 2026-07-20: disclosed: NVD publication date
- 2026-07-20: patched: Fix available in version 0.31.2