Skip to content
OpenAdvisories
High RHSA-2026:52807 2 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Sep 3, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 5

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 podman 5:6.0.2-2.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 podman-docker 5:6.0.2-2.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 podman-machine 5:6.0.2-2.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 podman-remote 5:6.0.2-2.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 podmansh 5:6.0.2-2.2.hum1

Vulnerabilities 2

  • High 7.2
    CVE-2026-75593

    BuildKit: Malicious client can bypass destination directory validation on local sources upload

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlle…

    moby BuildKit moby-engine Azure Linux
  • High 7.1
    CVE-2026-17106 Public exploit

    Tar extraction in moby/go-archive can write outside the destination directory via link following

    The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical str…

    Docker moby Docker Desktop Docker Sandboxes Debian Ubuntu Azure Linux Wolfi Go

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-75593
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-17106
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52807.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2518147
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-17106
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-17106
  • article
    https://docs.docker.com/desktop/release-notes/#4860
  • article
    https://docs.docker.com/engine/release-notes/29/#2970
  • article
    https://github.com/docker/cli/releases/tag/v29.7.0
  • article
    https://github.com/docker/compose/releases/tag/v5.4.0
  • article
    https://github.com/docker/sbx-releases/releases/tag/v0.38.0
  • article
    https://github.com/moby/go-archive/releases/tag/v0.3.0
  • article
    https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2519913
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-75593
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-75593
  • article
    https://github.com/moby/buildkit/releases/tag/v0.31.2
  • article
    https://github.com/moby/buildkit/security/advisories/GHSA-g2h8-426c-7976