CVE-2026-44517: Buildah Vulnerability Allows Build-Time Breakout via Malicious Containerfile or Git HTTP Server
Summary
CVE-2026-44517: Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah. Affects github.com/containers/buildah versions >= 1.38.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Buildah is an open-source tool that facilitates the building of container images. It allows users to create and manage container images without requiring a full container runtime. Key features include support for various image formats, integration with different container registries, and the ability to build images from Dockerfiles or Containerfiles. However, Buildah is vulnerable to a specific issue where a malicious Containerfile or Git HTTP server can lead to unauthorized access to files outside the build context.
Vulnerability Detail
The vulnerability arises when Buildah processes a crafted Git URL or Containerfile. During an ADD or COPY operation, these malicious inputs can manipulate the build context, allowing Buildah to access files that should remain isolated. This could lead to exposure of sensitive data or system files, posing a significant security risk to users and their environments.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using untrusted Containerfiles or Git URLs. Ensure that all sources are verified and trusted before executing build commands.
Conclusion
The vulnerability identified as CVE-2026-44517 in Buildah poses a significant risk due to the potential for unauthorized file access during the build process. Users are advised to update to the patched version to ensure their systems remain secure.
See every vulnerability recorded for github.com/containers/buildah →
FAQ
The vulnerability allows unauthorized access to files outside the build context, which can lead to data exposure and security breaches.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate update is not possible, ensure that you do not use untrusted Containerfiles or Git URLs to mitigate risks.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the Gopkg.lock file.
More information can be found in the official Go vulnerability database at https://pkg.go.dev/vuln/GO-2026-5116.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containers/buildah.
