CVE-2026-44517: Buildah Package Vulnerability Leading to Build Context Breakout
Summary
CVE-2026-44517: Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive. Affects github.com/containers/buildah versions >= 1.38.1, < 1.43.2. Fixed in 1.43.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Buildah is an open-source tool that facilitates the creation and management of container images. It allows users to build OCI and Docker container images from scratch or from existing images. The tool is widely used in containerized environments for its flexibility and efficiency. However, it has a vulnerability that can be exploited when processing build contexts or using add/copy instructions, potentially leading to unauthorized file access.
Vulnerability Detail
The vulnerability arises when a malicious server serving a Git repository or a tar archive file is involved in the build process. This can lead to files outside of the designated build context directory being included in the build context or copied into the build. The issue is classified under CWE-22, which pertains to improper limitation of a pathname to a restricted directory. This can have serious implications, as it may allow attackers to manipulate the build process and access sensitive files.
How To Fix
Latest published version: v1.43.5 as of 22 Oct 2026
go get github.com/containers/buildah@v1.43.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.43.2
This is the first release that contains the fix.
go get github.com/containers/buildah@v1.43.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using Git Smart HTTP servers or tar archives from untrusted sources during the build process. This reduces the risk of including malicious files in the build context.
Conclusion
The vulnerability identified as CVE-2026-44517 in the Buildah package poses a significant risk by allowing unauthorized file access during the build process. Users are strongly encouraged to update to the patched version 1.43.2 or later to mitigate this risk. Additionally, employing best practices in source management can help safeguard against potential exploits.
See every vulnerability recorded for github.com/containers/buildah →
FAQ
The CVSS score of this vulnerability is 6.3, indicating a moderate level of severity.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow unauthorized access to sensitive files outside the intended build context, leading to data breaches or system compromise.
Yes, Vulert provides real-time monitoring and alerts for open-source vulnerabilities using just the Gopkg.lock file, allowing you to stay informed about potential risks.
If immediate updating is not possible, ensure that you avoid using untrusted sources for Git repositories or tar archives in your build process as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containers/buildah.
