CVE-2026-15789 is a path traversal vulnerability (CWE-22) in BuildKit, a component used in Red Hat Hardened Images RPMs such as podman. A custom client with valid permissions to the BuildKit control API can craft upload requests that escape the BuildKit state directory, potentially allowing unauthorized reading or modification of files outside the intended directory. This flaw impacts integrity by enabling modification of critical files and confidentiality by exposing sensitive data. The vulnerability requires the attacker to have low privileges but valid access to the BuildKit daemon, thus restricting exploitation to environments where the control API is exposed or compromised. Red Hat has issued updated podman packages (version 6.0.2-2.3.hum1) for multiple architectures to fix this issue.

The vulnerability allows an attacker with valid BuildKit control API access to escape the intended directory restrictions, potentially leading to unauthorized modification or disclosure of sensitive files. This can compromise system integrity and confidentiality. The attack requires low privileges but valid access to the BuildKit daemon, limiting the risk to environments where the control API is exposed or compromised. There are no known exploits in the wild. The impact is rated medium by Red Hat.

Red Hat has released updated packages for podman and related components (version 6.0.2-2.3.hum1) that fix this vulnerability. Users should apply these updates to remediate the issue. Since this vulnerability requires valid BuildKit control API access, restricting access to the API and following least privilege principles can reduce exposure. Patch status is confirmed by Red Hat advisory RHSA-2026:62771. No additional mitigations are stated as necessary.