CVE-2026-44517

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44517", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-06T18:28:20.888Z", "datePublished": "2026-08-21T20:29:00.354Z", "dateUpdated": "2026-08-25T17:07:10.143Z"}, "containers": {"cna": {"title": "Buildah: Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/podman-container-tools/buildah/security/advisories/GHSA-49p4-px3h-rq49", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/podman-container-tools/buildah/security/advisories/GHSA-49p4-px3h-rq49"}, {"name": "https://github.com/podman-container-tools/buildah/commit/54459cf8a0feb4b1da766e4a6360451834e1846c", "tags": ["x_refsource_MISC"], "url": "https://github.com/podman-container-tools/buildah/commit/54459cf8a0feb4b1da766e4a6360451834e1846c"}, {"name": "https://github.com/podman-container-tools/buildah/commit/fc2003bb2efeb3ed7d5c7e1e88d04e78f370a944", "tags": ["x_refsource_MISC"], "url": "https://github.com/podman-container-tools/buildah/commit/fc2003bb2efeb3ed7d5c7e1e88d04e78f370a944"}, {"name": "https://github.com/podman-container-tools/buildah/releases/tag/v1.43.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/podman-container-tools/buildah/releases/tag/v1.43.2"}, {"name": "https://github.com/podman-container-tools/buildah/releases/tag/v1.44.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/podman-container-tools/buildah/releases/tag/v1.44.0"}], "affected": [{"vendor": "containers", "product": "buildah", "versions": [{"version": ">= 1.38.1, < 1.43.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-21T20:29:00.354Z"}, "descriptions": [{"lang": "en", "value": "Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left by a partially extracted tar archive. A malicious server supplying a Git repository or tar archive can cause files outside the build context directory to be included in the context or copied into the build. This issue is fixed in versions 1.43.2 and 1.44.0."}], "source": {"advisory": "GHSA-49p4-px3h-rq49", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-25T17:05:33.478033Z", "id": "CVE-2026-44517", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T17:07:10.143Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44517", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T17:05:33.478033Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T17:06:19.788Z"}}], "cna": {"title": "Buildah: Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive", "source": {"advisory": "GHSA-49p4-px3h-rq49", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "containers", "product": "buildah", "versions": [{"status": "affected", "version": ">= 1.38.1, < 1.43.2"}]}], "references": [{"url": "https://github.com/podman-container-tools/buildah/security/advisories/GHSA-49p4-px3h-rq49", "name": "https://github.com/podman-container-tools/buildah/security/advisories/GHSA-49p4-px3h-rq49", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/podman-container-tools/buildah/commit/54459cf8a0feb4b1da766e4a6360451834e1846c", "name": "https://github.com/podman-container-tools/buildah/commit/54459cf8a0feb4b1da766e4a6360451834e1846c", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/podman-container-tools/buildah/commit/fc2003bb2efeb3ed7d5c7e1e88d04e78f370a944", "name": "https://github.com/podman-container-tools/buildah/commit/fc2003bb2efeb3ed7d5c7e1e88d04e78f370a944", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/podman-container-tools/buildah/releases/tag/v1.43.2", "name": "https://github.com/podman-container-tools/buildah/releases/tag/v1.43.2", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/podman-container-tools/buildah/releases/tag/v1.44.0", "name": "https://github.com/podman-container-tools/buildah/releases/tag/v1.44.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left by a partially extracted tar archive. A malicious server supplying a Git repository or tar archive can cause files outside the build context directory to be included in the context or copied into the build. This issue is fixed in versions 1.43.2 and 1.44.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-21T20:29:00.354Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44517", "state": "PUBLISHED", "dateUpdated": "2026-08-25T17:07:10.143Z", "dateReserved": "2026-05-06T18:28:20.888Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-21T20:29:00.354Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "buildah", "vendor": "containers", "versions": [{"status": "affected", "version": ">= 1.38.1, < 1.43.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left by a partially extracted tar archive. A malicious server supplying a Git repository or tar archive can cause files outside the build context directory to be included in the context or copied into the build. This issue is fixed in versions 1.43.2 and 1.44.0."}, {"lang": "es", "value": "Buildah es una herramienta que facilita la creaci\u00f3n de im\u00e1genes OCI. Desde la versi\u00f3n 1.38.1 hasta la 1.43.2 y la 1.44.0, TempDirForURL en define/types.go no confina de forma segura los subdirectorios del repositorio Git al contexto de construcci\u00f3n descargado, y downloadToDirectory y stdinToDirectory pueden seguir un enlace simb\u00f3lico de Dockerfile dejado por un archivo tar parcialmente extra\u00eddo. Un servidor malicioso que suministra un repositorio Git o un archivo tar puede hacer que los archivos fuera del directorio del contexto de construcci\u00f3n se incluyan en el contexto o se copien en la construcci\u00f3n. Este problema est\u00e1 corregido en las versiones 1.43.2 y 1.44.0."}], "id": "CVE-2026-44517", "lastModified": "2026-10-12T16:10:00.220", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44517", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-25T17:05:33.478033Z", "version": "2.0.3"}}]}, "published": "2026-08-21T21:16:59.250", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/podman-container-tools/buildah/commit/54459cf8a0feb4b1da766e4a6360451834e1846c"}, {"source": "security-advisories@github.com", "url": "https://github.com/podman-container-tools/buildah/commit/fc2003bb2efeb3ed7d5c7e1e88d04e78f370a944"}, {"source": "security-advisories@github.com", "url": "https://github.com/podman-container-tools/buildah/releases/tag/v1.43.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/podman-container-tools/buildah/releases/tag/v1.44.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/podman-container-tools/buildah/security/advisories/GHSA-49p4-px3h-rq49"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/containers/buildah: Buildah: Build breakout via malicious Git repository or tar archive", "id": "2521191", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521191"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-22", "details": ["Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left by a partially extracted tar archive. A malicious server supplying a Git repository or tar archive can cause files outside the build context directory to be included in the context or copied into the build. This issue is fixed in versions 1.43.2 and 1.44.0.", "A flaw was found in Buildah. Insecure handling of temporary directories and symlinks during the image build process, specifically within `TempDirForURL`, `downloadToDirectory`, and `stdinToDirectory` functions, allows a malicious server supplying a Git repository or tar archive to cause files outside the build context directory to be included or copied into the build. This could lead to a build breakout, enabling an attacker to manipulate files on the host system."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-44517", "package_state": [{"cpe": "cpe:/a:redhat:certifications:9", "fix_state": "Fix deferred", "package_name": "rhcertification/redhat-certification-system-ai-10", "product_name": "Red Hat Certification Program for Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "buildah", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "podman", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "container-tools:rhel8/buildah", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "container-tools:rhel8/conmon", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "container-tools:rhel8/podman", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "buildah", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "conmon", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "podman", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "ubi9/buildah", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "buildah", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "conmon", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "cri-o", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift4/microshift-bootc-rhel10", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift4/oc-mirror-plugin-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift4/ose-docker-builder", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift4/ose-docker-builder-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift4/ose-machine-config-rhel9-operator", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "podman", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/udi-base-rhel10", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/udi-base-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/udi-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "rhoso-operators/prometheus-podman-exporter-rhel9", "product_name": "Red Hat OpenStack Platform 18.0"}, {"cpe": "cpe:/a:redhat:quay:3", "fix_state": "Fix deferred", "package_name": "quay/quay-builder-rhel8", "product_name": "Red Hat Quay 3"}, {"cpe": "cpe:/a:redhat:quay:3", "fix_state": "Fix deferred", "package_name": "quay/quay-builder-rhel9", "product_name": "Red Hat Quay 3"}], "public_date": "2026-08-21T20:29:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-44517\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44517\nhttps://github.com/podman-container-tools/buildah/commit/54459cf8a0feb4b1da766e4a6360451834e1846c\nhttps://github.com/podman-container-tools/buildah/commit/fc2003bb2efeb3ed7d5c7e1e88d04e78f370a944\nhttps://github.com/podman-container-tools/buildah/releases/tag/v1.43.2\nhttps://github.com/podman-container-tools/buildah/releases/tag/v1.44.0\nhttps://github.com/podman-container-tools/buildah/security/advisories/GHSA-49p4-px3h-rq49"], "statement": "Red Hat ships Buildah as a standalone package and as a bundled dependency in Podman across RHEL, OpenShift, and RHIVOS. Versions of Buildah from 1.38.1 through 1.43.1 are affected. Older streams (RHEL 8.x, RHEL 9.2, RHEL 9.4, OpenShift 4.12\u20134.18) ship Buildah versions below 1.38.1 and are not affected. RHEL 9.9 and RHEL 10.3 already ship the fixed version (1.43.2 and 1.45.0 respectively).", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.38.1,1.43.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "buildah", "source": "cna", "vendor": "containers"}, "product": "buildah", "vendor": "containers"}], "created": "2026-08-21T21:30:17.743708+00:00", "updated": "2026-08-23T16:40:40.545473+00:00", "vendors": ["containers", "containers$PRODUCT$buildah"]}