This Important security update for the buildah container tool on RHEL 10 addresses CVE-2026-39822, a directory traversal vulnerability in the Go `os.Root` function with a CVSS 3.1 score of 7.8 (High). The flaw, caused by improper symlink resolution, could allow an attacker to traverse directories outside the intended root. The advisory provides a patch; affected users should apply the update via the referenced Red Hat solution article.
Red Hat Product Errata RHSA-2026:38494 - Security Advisory Issued: 2026-07-13 Updated: 2026-07-13 RHSA-2026:38494 - Security Advisory Overview Updated Packages Synopsis Important: buildah security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for buildah is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 10 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 x86_64 Red Hat Enterprise Linux for IBM z Systems 10 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 s390x Red Hat Enterprise Linux for Power, little endian 10 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 ppc64le Red Hat Enterprise Linux for ARM 64 10 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 s390x Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 ppc64le Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 10.2 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 10.2 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 10.2 s390x Fixes BZ - 2498152 - CVE-2026-39822 os: golang: Go os.Root: Symlink following vulnerability allows directory traversal CVEs CVE-2026-39822 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 10 SRPM buildah-1.43.1-4.el10_2.src.rpm SHA-256: 411e362537c9b0284f9b4db31d87ecaabb863aab525e2506bcf386260ccc4b38 x86_64 buildah-1.43.1-4.el10_2.x86_64.rpm SHA-256: 7c367e07d3ced9eb036556a6926d920422c97527317a392dc65e2c2230d13d6a buildah-debuginfo-1.43.1-4.el10_2.x86_64.rpm SHA-256: 5e2226ec365b4b2095597c369285aa0eed555438c539bb7a1690446c220e1b77 buildah-debugsource-1.43.1-4.el10_2.x86_64.rpm SHA-256: d1c65733ae8cca58e36c8ed27b9cad03659f37c069e3cc7288b4a1440e2b7f4f buildah-tests-1.43.1-4.el10_2.x86_64.rpm SHA-256: 16afeb9c6adcdf4c58012841ab46526514f3ed56187d21cb6206e6d7921b1647 buildah-tests-debuginfo-1.43.1-4.el10_2.x86_64.rpm SHA-256: 46fc1da6cfb03d5a2682560c4111b296e55aee505b2f155c9a4d8641040b0ea2 Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 SRPM buildah-1.43.1-4.el10_2.src.rpm SHA-256: 411e362537c9b0284f9b4db31d87ecaabb863aab525e2506bcf386260ccc4b38 x86_64 buildah-1.43.1-4.el10_2.x86_64.rpm SHA-256: 7c367e07d3ced9eb036556a6926d920422c97527317a392dc65e2c2230d13d6a buildah-debuginfo-1.43.1-4.el10_2.x86_64.rpm SHA-256: 5e2226ec365b4b2095597c369285aa0eed555438c539bb7a1690446c220e1b77 buildah-debugsource-1.43.1-4.el10_2.x86_64.rpm SHA-256: d1c65733ae8cca58e36c8ed27b9cad03659f37c069e3cc7288b4a1440e2b7f4f buildah-tests-1.43.1-4.el10_2.x86_64.rpm SHA-256: 16afeb9c6adcdf4c58012841ab46526514f3ed56187d21cb6206e6d7921b1647 buildah-tests-debuginfo-1.43.1-4.el10_2.x86_64.rpm SHA-256: 46fc1da6cfb03d5a2682560c4111b296e55aee505b2f155c9a4d8641040b0ea2 Red Hat Enterprise Linux for IBM z Systems 10 SRPM buildah-1.43.1-4.el10_2.src.rpm SHA-256: 411e362537c9b0284f9b4db31d87ecaabb863aab525e2506bcf386260ccc4b38 s390x buildah-1.43.1-4.el10_2.s390x.rpm SHA-256: 7855efabdb9bbd0f53cc58087a602791b42d162f67658b2f58092721b6877026 buildah-debuginfo-1.43.1-4.el10_2.s390x.rpm SHA-256: 738866f557c1dc94566d944bb1651af0eb8c1c66f80f604d913e851f26e8f463 buildah-debugsource-1.43.1-4.el10_2.s390x.rpm SHA-256: 98d6b62cadd83d8adc3cca7a0870a93f4e57625eb17ca5406a6451b760973f31 buildah-tests-1.43.1-4.el10_2.s390x.rpm SHA-256: d87b205e183ddb7b39b3aaa5414cc1346294ef55662cb9b76de5f0a840b15d54 buildah-tests-debuginfo-1.43.1-4.el10_2.s390x.rpm SHA-256: bec5feabf4ff3786df910b331db5d851924522fcdc8fd5966312c00a8082fc73 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 SRPM buildah-1.43.1-4.el10_2.src.rpm SHA-256: 411e362537c9b0284f9b4db31d87ecaabb863aab525e2506bcf386260ccc4b38 s390x buildah-1.43.1-4.el10_2.s390x.rpm SHA-256: 7855efabdb9bbd0f53cc58087a602791b42d162f67658b2f58092721b6877026 buildah-debuginfo-1.43.1-4.el10_2.s390x.rpm SHA-256: 738866f557c1dc94566d944bb1651af0eb8c1c66f80f604d913e851f26e8f463 buildah-debugsource-1.43.1-4.el10_2.s390x.rpm SHA-256: 98d6b62cadd83d8adc3cca7a0870a93f4e57625eb17ca5406a6451b760973f31 buildah-tests-1.43.1-4.el10_2.s390x.rpm SHA-256: d87b205e183ddb7b39b3aaa5414cc1346294ef55662cb9b76de5f0a840b15d54 buildah-tests-debuginfo-1.43.1-4.el10_2.s390x.rpm SHA-256: bec5feabf4ff3786df910b331db5d851924522fcdc8fd5966312c00a8082fc73 Red Hat Enterprise Linux for Power, little endian 10 SRPM buildah-1.43.1-4.el10_2.src.rpm SHA-256: 411e362537c9b0284f9b4db31d87ecaabb863aab525e2506bcf386260ccc4b38 ppc64le buildah-1.43.1-4.el10_2.ppc64le.rpm SHA-256: 9448fd218caf90fe5160bc816fc4b3dbfc3a7fef7d06065cc9bfc009144b1355 buildah-debuginfo-1.43.1-4.el10_2.ppc64le.rpm SHA-256: e7fd0efff67bb49405276ad2b245f2b511d48f6997520fc34ea215be06df1cf7 buildah-debugsource-1.43.1-4.el10_2.ppc64le.rpm SHA-256: d33138728252f653f8097324ba2d8dca0f4b0bd1206c1dbddee8e5099e3721f8 buildah-tests-1.43.1-4.el10_2.ppc64le.rpm SHA-256: e56d02e78c843bf240274704ad5fcd861faa93169722ec9e161cf4e20ec32829 buildah-tests-debuginfo-1.43.1-4.el10_2.ppc64le.rpm SHA-256: ddf6151103d69f957e4484b4766fa7251e6a23121adba458ad8617876e25ce06 Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 SRPM buildah-1.43.1-4.el10_2.src.rpm SHA-256: 411e362537c9b0284f9b4db31d87ecaabb863aab525e2506bcf386260ccc4b38 ppc64le buildah-1.43.1-4.el10_2.ppc64le.rpm SHA-256: 9448fd218caf90fe5160bc816fc4b3dbfc3a7fef7d06065cc9bfc009144b1355 buildah-debuginfo-1.43.1-4.el10_2.ppc64le.rpm SHA-256: e7fd0efff67bb49405276ad2b245f2b511d48f6997520fc34ea215be06df1cf7 buildah-debugsource-1.43.1-4.el10_2.ppc64le.rpm SHA-256: d33138728252f653f8097324ba2d8dca0f4b0bd1206c1dbddee8e5099e3721f8 buildah-tests-1.43.1-4.el10_2.ppc64le.rpm SHA-256: e56d02e78c843bf240274704ad5fcd861faa93169722ec9e161cf4e20ec32829 buildah-tests-debuginfo-1.43.1-4.el10_2.ppc64le.rpm SHA-256: ddf6151103d69f957e4484b4766fa7251e6a23121adba458ad8617876e25ce06 Red Hat Enterprise Linux for ARM 64 10 SRPM buildah-1.43.1-4.el10_2.src.rpm SHA-256: 411e362537c9b0284f9b4db31d87ecaabb863aab525e2506bcf386260ccc4b38 aarch64 buildah-1.43.1-4.el10_2.aarch64.rpm SHA-256: cc479137d66b3a4864717faed31b356fa4279be3547389a5290085e6b53b25f8 buildah-debuginfo-1.43.1-4.el10_2.aarch64.rpm SHA-256: a6a9f35ebbf4d3fd3695e565ddb51db3c504e02ab07b96e6bac5b56c20d88757 buildah-debugsource-1.43.1-4.el10_2.aarch64.rpm SHA-256: 63e425f9a8d88f391462da37a16e8b2bfa5360c3e0f66f9c65203daa3ac6cc74 buildah-tests-1.43.1-4.el10_2.aarch64.rpm SHA-256: 1d734dd9bd429b4cbe4a846db8648a411f7e9d23190c1e862872120c7eb96627 buildah-tests-debuginfo-1.43.1-4.el10_2.aarch64.rpm SHA-256: 16730c1b9f78fbba2484000a714015353f2c9149a09429ab62466e73bf9c8708 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 SRPM buildah-1.43.1-4.el10_2.src.rpm SHA-256: 411e362537c9b0284f9b4db31d87ecaabb863aab525e2506bcf386260ccc4b38 aarch64 buildah-1.43.1-4.el10_2.aarch64.rpm SHA-256: cc479137d66b3a4864717faed31b356fa4279be3547389a5290085e6b53b25f8 buildah-debuginfo-1.43.1-4.el10_2.aarch64.rpm SHA-256: a6a9f35ebbf4d3fd3695e565ddb51db3c504e02ab07b96e6bac5b56c20d88757 buildah-debugsource-1.43.1-4.el10_2.aarch64.rpm SHA-256: 63e425f9a8d88f391462da37a16e8b2bfa5360c3e0f66f9c65203daa3ac6cc74 buildah-tests-1.43.1-4.el10_2.aarch64.rpm SHA-256: 1d734dd9bd429b4cbe4a846db8648a411f7e9d23190c1e862872120c7eb96627 buildah-tests-debuginfo-1.43.1-4.el10_2.aarch64.rpm SHA-256: 16730c1b9f78fbba2484000a714015353f2c9149a09429ab62466e73bf9c8708 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 SRPM buildah-1.43.1-4.el10_2.src.rpm SHA-256: 411e362537c9b0284f9b4db31d87ecaabb863aab525e2506bcf386260ccc4b38 aarch64 buildah-1.43.1-4.el10_2.aarch64.rpm SHA-256: cc479137d66b3a4864717faed31b356fa4279be3547389a5290085e6b53b25f8 buildah-debuginfo-1.43.1-4.el10_2.aarch64.rpm SHA-256: a6a9f35ebbf4d3fd3695e565ddb51db3c504e02ab07b96e6bac5b56c20d88757 buildah-debugsource-1.43.1-4.el10_2.aarch64.rpm SHA-256: 63e425f9a8d88f391462da37a16e8b2bfa5360c3e0f66f9c65203daa3ac6cc74 buildah-tests-1.43.1-4.el10_2.aarch64.rpm SHA-256: 1d734dd9bd429b4cbe4a846db8648a411f7e9d23190c1e862872120c7eb96627 buildah-tests-debuginfo-1.43.1-4.el10_2.aarch64.rpm SHA-256: 16730c1b9f78fbba2484000a714015353f2c9149a09429ab62466e73bf9c8708 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 SRPM buildah-1.43.1-4.el10_2.src.r