This page tracks the BellSoft Alpaquita fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-56854 →

BELL-CVE-2026-56854

Vulnerability in buildah (BELL-CVE-2026-56854)

Summary

Vulnerability in buildah (BELL-CVE-2026-56854). Confidential information can be exposed externally.

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A weakness called BELL-CVE-2026-56854 was discovered in buildah.
Severity is Info. Low severity or not yet rated.
What you should do: update the affected software to the latest version. If unsure, ask your IT team or search the vendor's site for "buildah BELL-CVE-2026-56854".

BELL-CVE-2026-56854 (buildah). Severity: Info.
Response plan:

Check the vendor advisory for affected versions and the patched release.
If a vulnerable version is running in production, schedule maintenance (urgency from KEV/CVSS).
If no patch yet, mitigate via WAF rule, disabling the affected feature, etc.
Monitor logs / SIEM for known IOC and PoC signatures of this CVE.
PoCs and fix commits: see the 'References' section, MITRE, and NVD.

❓ What is the problem

A weakness (BELL-CVE-2026-56854) in buildah. A serious software flaw has been identified.

📍 Affected scope

Target versions of buildah (see vendor advisory). If running in production, identify exposure immediately.

🔥 Severity

Severity: Info. Low severity or not yet rated.

🔧 How to fix

Update to the patched release as listed in the vendor advisory.

🛡️ Workaround

If a patch is not yet available, consider disabling the affected feature, applying WAF rules, blocking via network ACLs, or isolating the vulnerable version.

🔍 Detection

Check version information, scan dependencies via SBOM, and monitor SIEM for IOC and PoC signatures related to this CVE.

Affected packages

Alpaquita:23 buildah

[{"type":"ECOSYSTEM","events":[{"introduced":"1.28.0-r1"}]}]

Alpaquita:23 containerd

[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.10-r0"}]}]

Alpaquita:23 podman

[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.1-r0"}]}]

Alpaquita:23 skopeo

[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0-r2"}]}]

Alpaquita:25 buildah

[{"type":"ECOSYSTEM","events":[{"introduced":"1.40.0-r0"}]}]

Alpaquita:25 calicoctl

[{"type":"ECOSYSTEM","events":[{"introduced":"3.31.3-r0"}]}]

Alpaquita:25 cilium-cli

[{"type":"ECOSYSTEM","events":[{"introduced":"0.19.0-r12"}]}]

Alpaquita:25 containerd

[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.1-r0"}]}]

Alpaquita:25 docker

[{"type":"ECOSYSTEM","events":[{"introduced":"28.2.1-r0"}]}]

Alpaquita:25 docker-cli-buildx

[{"type":"ECOSYSTEM","events":[{"introduced":"0.24.0-r0"}]}]

Alpaquita:25 etcd

[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.4-r6"}]}]

Alpaquita:25 google-guest-agent

[{"type":"ECOSYSTEM","events":[{"introduced":"20250521.00-r0"}]}]

Alpaquita:25 helm

[{"type":"ECOSYSTEM","events":[{"introduced":"3.19.0-r4"}]}]

Alpaquita:25 kubernetes

[{"type":"ECOSYSTEM","events":[{"introduced":"1.35.0-r1"}]}]

Alpaquita:25 osv-scanner

[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0-r4"}]}]

Alpaquita:25 podman

[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0-r0"}]}]

Alpaquita:25 rootlesskit

[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.5-r0"}]}]

Alpaquita:25 skopeo

[{"type":"ECOSYSTEM","events":[{"introduced":"1.18.0-r2"}]}]

Alpaquita:stream buildah

[{"type":"ECOSYSTEM","events":[{"introduced":"1.31.0-r0"}]}]

Alpaquita:stream calicoctl

[{"type":"ECOSYSTEM","events":[{"introduced":"3.31.3-r0"}]}]

Alpaquita:stream cilium-cli

[{"type":"ECOSYSTEM","events":[{"introduced":"0.19.0-r12"}]}]

Alpaquita:stream containerd

[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.2-r1"}]}]

Alpaquita:stream docker

[{"type":"ECOSYSTEM","events":[{"introduced":"24.0.2-r0"}]}]

Alpaquita:stream docker-cli-buildx

[{"type":"ECOSYSTEM","events":[{"introduced":"0.11.0-r0"}]}]

Alpaquita:stream etcd

[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.4-r6"}]}]

Alpaquita:stream google-guest-agent

[{"type":"ECOSYSTEM","events":[{"introduced":"20250214.01-r0"}]}]

Alpaquita:stream grype

[{"type":"ECOSYSTEM","events":[{"introduced":"0.100.0-r0"}]}]

Alpaquita:stream helm

[{"type":"ECOSYSTEM","events":[{"introduced":"3.19.0-r4"}]}]

Alpaquita:stream kubernetes

[{"type":"ECOSYSTEM","events":[{"introduced":"1.35.0-r1"}]}]

Alpaquita:stream osv-scanner

[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0-r2"}]}]

Alpaquita:stream podman

[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.1-r1"}]}]

Alpaquita:stream rootlesskit

[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0-r0"}]}]

Alpaquita:stream skopeo

[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.0-r1"}]}]

References

advisory docs.bell-sw.com