Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 23

Export CSV
CVE-2026-121520

Malicious client could set xattr value outside of BuildKit state directory

In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.

CVSS 4.0 · 4.5 Medium EPSS < 1% KEV · Not listed
Vendors
Moby
Products
Buildkit
CVE-2026-121522

Possible panic from Git source resolver

In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2.

CVSS 4.0 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Moby
Products
Buildkit
CVE-2026-93326

Crafted Git build source can bypass certain policy validation

A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look like it is coming from a different remote URL than it really is when Git clone is happening. If policy is doing more stricter validation, for example based on commit SHA, commit data, or signatures, then all these validations still apply correctly.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Moby
Products
Buildkit
CVE-2026-93321

Malformed LLB file operation can crash buildkitd

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Moby
Products
Buildkit
CVE-2026-93315

BuildKit proxy CA cleanup can be disrupted by build steps

When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Moby
Products
Buildkit
CVE-2026-93319

A malicious frontend can cause a daemon panic

A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Moby
Products
Buildkit
CVE-2026-93323

Oversized Dockerfile or .dockerignore can exhaust buildkitd memory

The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing an oversized file could make buildkitd allocate memory proportional to that file, potentially exhausting memory and terminating the daemon, which interrupts other builds on the same instance. Fixed by rejecting such files above 16 MiB.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Moby
Products
Buildkit
CVE-2026-93318

Cache poisoning via unvalidated image layer DiffIDs

A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents. If a BuildKit daemon with shared or persistent cache first processes such a malicious image, a later build using the victim image may mount the attacker-controlled layer contents as the base image. This can allow code from the malicious image to run in the victim build, for example by replacing a commonly executed path such as /bin/sh. The attacker-controlled code may read build secrets mounted into the build, access other build resources, alter output artifacts, or hang the build. The issue affects both regular snapshotters and lazy-pulling snapshotters such as stargz.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Moby
Products
Buildkit
CVE-2026-93322

Malformed MergeOp can crash the BuildKit daemon

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Moby
Products
Buildkit
CVE-2026-93320

BuildKit improperly handles special files in build snapshots

BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Moby
Products
Buildkit
CVE-2026-93317

Container blob cache can accept unverified content

An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Moby
Products
Buildkit
CVE-2026-93316

Starting daemon with --cdi-disabled flag can lead to panic on specific builds

If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices. This can happen maliciously or by accident.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Moby
Products
Buildkit
CVE-2026-75593

BuildKit: Malicious client can bypass destination directory validation on local sources upload

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access BuildKit control API to issue builds, eg., bypass authentication, etc. This issue is fixed in version 0.31.2.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Moby
Products
Buildkit
CVE-2026-61712

BuildKit: Possible runtime DoS via unbounded group parsing

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files without an upper bound while resolving a username to a user identifier or group identifier in executor/oci/user.go and solver/llbsolver/ops/user_linux.go. A malicious base image or build could provide oversized files that exhausted memory during user resolution and caused out-of-memory termination of the buildkitd process. This issue is fixed in version 0.31.1.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Moby
Products
Buildkit
CVE-2026-61711

BuildKit: Custom frontend could bypass Seccomp/AppArmor

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/spec_linux.go treated the unsupported value as a non-sandbox mode without requiring the security.insecure entitlement. This disabled Seccomp and AppArmor protections for the build container even though Linux capabilities remained restricted. This issue is fixed in version 0.31.1.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Moby
Products
Buildkit
CVE-2026-15791

LLB file operation can be tricked to remove /tmp directory contents

A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory.

CVSS 4.0 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Moby Mobyproject
Products
Buildkit Buildkit
CVE-2026-15792

Possible panic when incorrect parameters sent from frontend

A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Moby Mobyproject
Products
Buildkit Buildkit
CVE-2026-15793

Git source checkout from a bundle file could lead to command injection

BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host.

CVSS 4.0 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Moby Mobyproject
Products
Buildkit Buildkit
CVE-2026-15789

Malicious client can bypass destination directory validation on local sources upload

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Moby Mobyproject
Products
Buildkit Buildkit
CVE-2026-15788

WCOW cache mount source selector resolves NTFS junctions outside of cache root

BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root. A build authored by an untrusted user on a WCOW-configured BuildKit daemon can read arbitrary host files reachable to the BuildKit daemon process.

CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Moby Mobyproject
Products
Buildkit Buildkit