Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

A flaw in BuildKit allows an authenticated client with access to the BuildKit control API to perform a path traversal attack, escaping the BuildKit-controlled state directory. This enables unauthorized modification or deletion of files outside the intended directory. The issue affects BuildKit versions used in Red Hat Hardened Images, specifically the trivy RPMs updated to version 0.73.0-0.1.hum1. The vulnerability requires valid permissions to the API, limiting the attack surface. The flaw is tracked as CVE-2026-75593 and is categorized under CWE-22. Red Hat has issued an advisory (RHSA-2026:50953) with updated RPMs to address this issue.

An attacker with valid permissions to the BuildKit control API can exploit this vulnerability to modify or delete files outside the intended build directory. This can lead to unauthorized code execution, bypass of security mechanisms, exposure of sensitive data, or denial of service by corrupting critical files. The attack requires low privileges but no user interaction. Confidentiality impact is none, but integrity impact is high, and availability impact is none according to Red Hat's assessment.

Red Hat has released updated RPMs (trivy-0.73.0-0.1.hum1) as a bug fix and enhancement update for Red Hat Hardened Images. Users should apply these updates to remediate the vulnerability. Additionally, access to the BuildKit control API should be restricted to trusted users and services only, with robust authentication and authorization policies to prevent unauthorized access. No other mitigations are stated by the vendor.