CVE-2026-15789 is a path traversal vulnerability in BuildKit, a component used by OpenShift Source To Image. A custom client with valid permissions to the BuildKit control API can craft an upload request that escapes the BuildKit-controlled state directory, potentially allowing unauthorized modification or disclosure of sensitive data. The vulnerability requires the attacker to already have access to the BuildKit daemon, thus limiting exploitation to environments where the control API is exposed or compromised. Red Hat classifies this vulnerability as having a moderate impact with a CVSS base score of 6.5 (Red Hat) and 7.5 (NVD), primarily affecting integrity with no confidentiality or availability impact. The issue is tracked under CWE-22 (Path Traversal).

An attacker with valid BuildKit control API permissions can escape the BuildKit state directory to read or modify files outside the intended scope. This can lead to unauthorized modification or disclosure of sensitive data and potentially bypass security mechanisms relying on file integrity. The vulnerability requires prior access to the BuildKit daemon, so the attack surface is limited to environments where the control API is exposed or compromised. There is no direct impact on availability.

Red Hat recommends upgrading to OpenShift Source To Image version 1.6.4, which addresses this vulnerability. Users should apply this update to remediate the issue. Since the vulnerability requires valid permissions to the BuildKit control API, restricting access to this API can also reduce risk. No other mitigations are specified by the vendor.