This Red Hat security advisory (RHSA-2026:51065) addresses two vulnerabilities in the Buildah RPMs, specifically CVE-2026-15788 and CVE-2026-56852. CVE-2026-15788 is a path traversal vulnerability in BuildKit when used on Windows Containers on Windows (WCOW) configurations, allowing an untrusted user to read arbitrary files from the host via improper handling of NTFS directory junctions. This leads to information disclosure. The advisory references CWE-22 (Path Traversal) and CWE-835, indicating improper pathname limitation and related issues. The affected package version is buildah-1.45.0-2.hum1 for aarch64 and x86_64 architectures. Red Hat provides this update to mitigate these vulnerabilities. No CVSS score is provided by Red Hat, but the impact is considered high. No known active exploits have been reported. The vendor advisory does not explicitly state a fixed version but provides the updated RPM version as the security update.

The vulnerability allows an untrusted user to read arbitrary files on the host system when authoring a build on a Windows Container on Windows configured BuildKit daemon, resulting in information disclosure. This can expose sensitive data from the host environment. There is no indication of integrity or availability impact beyond information disclosure. No known exploits in the wild have been reported. The severity is high due to the confidentiality impact and ease of exploitation without privileges.

Red Hat has released an updated buildah RPM version 1.45.0-2.hum1 that addresses these vulnerabilities. Users should apply this update to mitigate the risk. Since this is not a cloud service, remediation requires manual update of the affected packages. No additional mitigations or workarounds are specified in the advisory. Patch status is confirmed by the vendor advisory indicating the updated RPM version. No action beyond applying the update is required.