The buildah package, used for building OCI and Docker container images, contained a symlink following vulnerability in the Go os.Root function (CVE-2026-39822) that allows directory traversal. This vulnerability is classified under CWE-59. Red Hat has issued an important security advisory (RHSA-2026:38493) providing updated buildah packages that fix this issue. The advisory covers Red Hat Enterprise Linux 9 across multiple architectures including x86_64, s390x, ppc64le, and aarch64. The fix is included in buildah version 1.43.1-4.el9_8. No CVSS score is provided in the advisory, but the severity is rated as important.

The vulnerability allows an attacker to exploit symlink following behavior in the Go os.Root function, leading to directory traversal. This could potentially allow unauthorized access or modification of files outside the intended directory scope during container image building operations. The impact is significant enough for Red Hat to rate the update as important, indicating a high security risk if unpatched.

Red Hat has released updated buildah packages (version 1.43.1-4.el9_8) that address this vulnerability. Users of Red Hat Enterprise Linux 9 and its variants should apply the update promptly following Red Hat's official guidance at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.