Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-21T20:29:00 github.com/containers/buildah: Buildah: Build breakout via malicious Git repository or tar archive 6.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N CWE-22

Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left by a partially extracted tar archive. A malicious server supplying a Git repository or tar archive can cause files outside the build context directory to be included in the context or copied into the build. This issue is fixed in versions 1.43.2 and 1.44.0.

A flaw was found in Buildah. Insecure handling of temporary directories and symlinks during the image build process, specifically within `TempDirForURL`, `downloadToDirectory`, and `stdinToDirectory` functions, allows a malicious server supplying a Git repository or tar archive to cause files outside the build context directory to be included or copied into the build. This could lead to a build breakout, enabling an attacker to manipulate files on the host system.

Red Hat ships Buildah as a standalone package and as a bundled dependency in Podman across RHEL, OpenShift, and RHIVOS. Versions of Buildah from 1.38.1 through 1.43.1 are affected. Older streams (RHEL 8.x, RHEL 9.2, RHEL 9.4, OpenShift 4.12–4.18) ship Buildah versions below 1.38.1 and are not affected. RHEL 9.9 and RHEL 10.3 already ship the fixed version (1.43.2 and 1.45.0 respectively). Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat Certification Program for Red Hat Enterprise Linux 9 Fix deferred rhcertification/redhat-certification-system-ai-10 Red Hat Enterprise Linux 10 Fix deferred buildah Red Hat Enterprise Linux 10 Fix deferred podman Red Hat Enterprise Linux 8 Not affected container-tools:rhel8/buildah Red Hat Enterprise Linux 8 Not affected container-tools:rhel8/conmon Red Hat Enterprise Linux 8 Not affected container-tools:rhel8/podman Red Hat Enterprise Linux 9 Fix deferred buildah Red Hat Enterprise Linux 9 Not affected conmon Red Hat Enterprise Linux 9 Fix deferred podman Red Hat Enterprise Linux 9 Fix deferred ubi9/buildah Red Hat Hardened Images Not affected buildah Red Hat OpenShift Container Platform 4 Not affected conmon Red Hat OpenShift Container Platform 4 Not affected cri-o Red Hat OpenShift Container Platform 4 Fix deferred openshift4/microshift-bootc-rhel10 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/oc-mirror-plugin-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-docker-builder Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-docker-builder-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-machine-config-rhel9-operator Red Hat OpenShift Container Platform 4 Fix deferred podman Red Hat OpenShift Dev Spaces Fix deferred devspaces/udi-base-rhel10 Red Hat OpenShift Dev Spaces Fix deferred devspaces/udi-base-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/udi-rhel9 Red Hat OpenStack Platform 18.0 Fix deferred rhoso-operators/prometheus-podman-exporter-rhel9 Red Hat Quay 3 Fix deferred quay/quay-builder-rhel8 Red Hat Quay 3 Fix deferred quay/quay-builder-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-44517 https://nvd.nist.gov/vuln/detail/CVE-2026-44517 https://github.com/podman-container-tools/buildah/commit/54459cf8a0feb4b1da766e4a6360451834e1846c https://github.com/podman-container-tools/buildah/commit/fc2003bb2efeb3ed7d5c7e1e88d04e78f370a944 https://github.com/podman-container-tools/buildah/releases/tag/v1.43.2 https://github.com/podman-container-tools/buildah/releases/tag/v1.44.0 https://github.com/podman-container-tools/buildah/security/advisories/GHSA-49p4-px3h-rq49