Threat database

CVE-2026-44517 is a path traversal vulnerability in the Buildah tool used for building OCI images. Versions from 1.38.1 up to but not including 1.43.2, and a range starting at 1.44.0 but excluding 1.44.0, are affected. The vulnerability allows a malicious Git repository or tar archive server to cause files outside the intended build context directory to be included or copied into the build process. This issue is fixed in versions 1.43.2 and 1.44.0. The CVSS 3.1 score is 6.3, indicating a medium severity impact with high confidentiality impact but no integrity or availability impact.

A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.

A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time.