Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
A security update for Red Hat Hardened Images RPMs addresses two vulnerabilities in the BuildKit component, including CVE-2026-15788. The primary issue in CVE-2026-15788 involves an information disclosure flaw where an untrusted user can exploit a cache mount source selector vulnerability on Windows Container on Windows (WCOW) configured BuildKit daemons to read arbitrary files on the host system. This could lead to sensitive information exposure. The update includes fixed RPM packages for buildah version 1.45.0-2.hum1 on aarch64 and x86_64 architectures. No known exploits are reported in the wild. The vendor advisory confirms the availability of the update and provides guidance for applying it.
AI Analysis
Technical Summary
CVE-2026-15788 is a vulnerability in BuildKit used by Red Hat Hardened Images, specifically affecting buildah RPMs. It allows an untrusted user authoring a build on a Windows Container on Windows configured BuildKit daemon to exploit improper handling of NTFS directory junctions in the cache mount source selector, resulting in arbitrary file read access on the host system (information disclosure). This is classified under CWE-22 (Path Traversal) and CWE-835. The flaw can lead to confidentiality breaches by exposing sensitive host files. The Red Hat advisory RHSA-2026:51065 provides updated buildah packages (1.45.0-2.hum1) that fix this issue. No CVSS score is provided by Red Hat, but the impact is rated high due to confidentiality impact. No exploits in the wild are currently known.
Potential Impact
The vulnerability allows an untrusted user to read arbitrary files from the host system when using BuildKit with Windows Container on Windows configuration, leading to information disclosure. This could expose sensitive data and potentially bypass security mechanisms relying on file confidentiality. There is no indication of integrity or availability impact from this vulnerability. No known active exploitation has been reported.
Mitigation Recommendations
A security update is available from Red Hat that addresses these vulnerabilities in the buildah RPMs (version 1.45.0-2.hum1). Users should apply this update promptly to remediate the issue. The vendor advisory provides instructions for applying the update. No additional mitigations or workarounds are specified or required beyond applying the official fix.
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Description
A security update for Red Hat Hardened Images RPMs addresses two vulnerabilities in the BuildKit component, including CVE-2026-15788. The primary issue in CVE-2026-15788 involves an information disclosure flaw where an untrusted user can exploit a cache mount source selector vulnerability on Windows Container on Windows (WCOW) configured BuildKit daemons to read arbitrary files on the host system. This could lead to sensitive information exposure. The update includes fixed RPM packages for buildah version 1.45.0-2.hum1 on aarch64 and x86_64 architectures. No known exploits are reported in the wild. The vendor advisory confirms the availability of the update and provides guidance for applying it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-15788 is a vulnerability in BuildKit used by Red Hat Hardened Images, specifically affecting buildah RPMs. It allows an untrusted user authoring a build on a Windows Container on Windows configured BuildKit daemon to exploit improper handling of NTFS directory junctions in the cache mount source selector, resulting in arbitrary file read access on the host system (information disclosure). This is classified under CWE-22 (Path Traversal) and CWE-835. The flaw can lead to confidentiality breaches by exposing sensitive host files. The Red Hat advisory RHSA-2026:51065 provides updated buildah packages (1.45.0-2.hum1) that fix this issue. No CVSS score is provided by Red Hat, but the impact is rated high due to confidentiality impact. No exploits in the wild are currently known.
Potential Impact
The vulnerability allows an untrusted user to read arbitrary files from the host system when using BuildKit with Windows Container on Windows configuration, leading to information disclosure. This could expose sensitive data and potentially bypass security mechanisms relying on file confidentiality. There is no indication of integrity or availability impact from this vulnerability. No known active exploitation has been reported.
Mitigation Recommendations
A security update is available from Red Hat that addresses these vulnerabilities in the buildah RPMs (version 1.45.0-2.hum1). Users should apply this update promptly to remediate the issue. The vendor advisory provides instructions for applying the update. No additional mitigations or workarounds are specified or required beyond applying the official fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:51065
- Cve Count
- 2
- Additional Cves
- ["CVE-2026-56852"]
- Cvss Version
- null
Threat ID: 6a74cf8fbf8831d5391aef3c
Added to database: 08/06/2026, 18:16:47 UTC
Last enriched: 08/06/2026, 18:43:39 UTC
Last updated: 08/07/2026, 03:40:59 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.