Every CVESearch/Get API key

CVE-2026-121520

Malicious client could set xattr value outside of BuildKit state directory

4.5 Medium

CVE-2026-121520 is a medium vulnerability (CVSS 4.5) in Moby Buildkit, published November 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. No source names a fixed version.

What does this mean?
Severity
4.5 MediumCVSS 4.0, CVE List
Exploit chance
0.14%EPSS, 3rd percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
No fix listedNo source names one

Description

In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
None

Exploit likelihood

0.14%Unchanged since Nov 4, 2026
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
docker-buildx
Azure Linux:3
through 0.14.0-20None known
docker-compose
Azure Linux:3
through 2.27.0-17None known
moby-engine
Azure Linux:3
through 25.0.18-2None known
podman
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
before 5:6.1.4-1.3.hum1
5:6.1.4-1.3.hum1
podman-docker
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
before 5:6.1.4-1.3.hum1
5:6.1.4-1.3.hum1
podman-machine
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
before 5:6.1.4-1.3.hum1
5:6.1.4-1.3.hum1
podman-remote
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
before 5:6.1.4-1.3.hum1
5:6.1.4-1.3.hum1
podmansh
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
before 5:6.1.4-1.3.hum1
5:6.1.4-1.3.hum1
docker.io
Ubuntu:Pro:16.04:LTS
All versions, plus listed versions
1.6.2~dfsg1-1ubuntu41.10.2-0ubuntu31.10.2-0ubuntu41.10.3-0ubuntu11.10.3-0ubuntu4
Show 19 moreShow less
1.10.3-0ubuntu51.10.3-0ubuntu61.11.2-0ubuntu5~16.041.12.1-0ubuntu13~16.04.11.12.3-0ubuntu4~16.04.21.12.6-0ubuntu1~16.04.11.13.1-0ubuntu1~16.04.217.03.2-0ubuntu2~16.04.118.06.1-0ubuntu1~16.04.218.06.1-0ubuntu1.2~16.04.118.09.2-0ubuntu1~16.04.118.09.5-0ubuntu1~16.04.218.09.7-0ubuntu1~16.04.118.09.7-0ubuntu1~16.04.418.09.7-0ubuntu1~16.04.518.09.7-0ubuntu1~16.04.618.09.7-0ubuntu1~16.04.718.09.7-0ubuntu1~16.04.9+esm118.09.7-0ubuntu1~16.04.9+esm2
None known
docker.io
Ubuntu:Pro:18.04:LTS
All versions, plus listed versions
1.13.1-0ubuntu617.03.2-0ubuntu117.03.2-0ubuntu317.03.2-0ubuntu517.12.1-0ubuntu1
Show 22 moreShow less
18.06.1-0ubuntu1~18.04.118.06.1-0ubuntu1.2~18.04.118.09.2-0ubuntu1~18.04.118.09.5-0ubuntu1~18.04.218.09.7-0ubuntu1~18.04.118.09.7-0ubuntu1~18.04.318.09.7-0ubuntu1~18.04.419.03.6-0ubuntu1~18.04.119.03.6-0ubuntu1~18.04.219.03.6-0ubuntu1~18.04.320.10.2-0ubuntu1~18.04.220.10.2-0ubuntu1~18.04.320.10.7-0ubuntu1~18.04.120.10.7-0ubuntu1~18.04.220.10.7-0ubuntu5~18.04.220.10.7-0ubuntu5~18.04.320.10.12-0ubuntu2~18.04.120.10.21-0ubuntu1~18.04.220.10.21-0ubuntu1~18.04.320.10.21-0ubuntu1~18.04.3+esm120.10.21-0ubuntu1~18.04.3+esm220.10.21-0ubuntu1~18.04.3+esm3
None known
Show 10 moreShow less
Affected packages
PackageAffectedFixed
docker.io
Ubuntu:Pro:20.04:LTS
All versions, plus listed versions
19.03.2-0ubuntu119.03.6-0ubuntu119.03.8-0ubuntu119.03.8-0ubuntu1.20.0419.03.8-0ubuntu1.20.04.1
Show 15 moreShow less
19.03.8-0ubuntu1.20.04.220.10.2-0ubuntu1~20.04.220.10.2-0ubuntu1~20.04.320.10.7-0ubuntu1~20.04.120.10.7-0ubuntu1~20.04.220.10.7-0ubuntu5~20.04.120.10.7-0ubuntu5~20.04.220.10.12-0ubuntu2~20.04.120.10.21-0ubuntu1~20.04.120.10.21-0ubuntu1~20.04.220.10.21-0ubuntu1~20.04.420.10.21-0ubuntu1~20.04.520.10.21-0ubuntu1~20.04.620.10.21-0ubuntu1~20.04.6+esm120.10.21-0ubuntu1~20.04.6+esm2
None known
docker.io-app
Ubuntu:Pro:20.04:LTS
All versions, plus listed versions
20.10.25-0ubuntu1~20.04.120.10.25-0ubuntu1~20.04.224.0.5-0ubuntu1~20.04.124.0.7-0ubuntu2~20.04.126.1.3-0ubuntu1~20.04.126.1.3-0ubuntu1~20.04.1+esm126.1.3-0ubuntu1~20.04.1+esm2
None known
docker.io
Ubuntu:Pro:22.04:LTS
All versions, plus listed versions
20.10.7-0ubuntu520.10.7-0ubuntu720.10.12-0ubuntu120.10.12-0ubuntu220.10.12-0ubuntu3
Show 11 moreShow less
20.10.12-0ubuntu3+gke1.24.120.10.12-0ubuntu420.10.21-0ubuntu1~22.04.220.10.21-0ubuntu1~22.04.320.10.21-0ubuntu1~22.04.520.10.21-0ubuntu1~22.04.620.10.21-0ubuntu1~22.04.720.10.21-0ubuntu1~22.04.7+esm120.10.21-0ubuntu1~22.04.7+esm220.10.21-0ubuntu1~22.04.820.10.21-0ubuntu1~22.04.8+esm1
None known
docker.io-app
Ubuntu:Pro:22.04:LTS
All versions, plus listed versions
20.10.25-0ubuntu1~22.04.120.10.25-0ubuntu1~22.04.224.0.5-0ubuntu1~22.04.124.0.7-0ubuntu2~22.04.126.1.3-0ubuntu1~22.04.1
Show 6 moreShow less
26.1.3-0ubuntu1~22.04.1+esm127.5.1-0ubuntu3~22.04.127.5.1-0ubuntu3~22.04.228.2.2-0ubuntu1~22.04.129.1.3-0ubuntu3~22.04.129.1.3-0ubuntu3~22.04.2
None known
docker.io
Ubuntu:Pro:24.04:LTS
All versions, plus listed versions
20.10.24+dfsg1-1ubuntu220.10.25+dfsg1-2ubuntu120.10.25+dfsg1-2ubuntu1+esm120.10.25+dfsg1-2ubuntu1+esm220.10.25+dfsg1-2ubuntu1.24.04.120.10.25+dfsg1-2ubuntu1.24.04.1+esm1
None known
docker.io-app
Ubuntu:Pro:24.04:LTS
All versions, plus listed versions
24.0.5-0ubuntu124.0.7-0ubuntu124.0.7-0ubuntu224.0.7-0ubuntu324.0.7-0ubuntu4
Show 8 moreShow less
24.0.7-0ubuntu4.126.1.3-0ubuntu1~24.04.126.1.3-0ubuntu1~24.04.1+esm127.5.1-0ubuntu3~24.04.127.5.1-0ubuntu3~24.04.228.2.2-0ubuntu1~24.04.129.1.3-0ubuntu3~24.04.129.1.3-0ubuntu3~24.04.2
None known
docker.io
Ubuntu:26.10
All versions, plus listed versions
27.5.1+dfsg4-2ubuntu128.5.2+dfsg4-5ubuntu1
None known
docker.io-app
Ubuntu:26.10
All versions, plus listed versions
29.1.3-0ubuntu429.1.3-0ubuntu529.1.3-0ubuntu629.7.2-0ubuntu1
None known
docker.io
Ubuntu:26.04:LTS
All versions, plus listed versions
26.1.5+dfsg1-9ubuntu127.5.1+dfsg4-1ubuntu127.5.1+dfsg4-2ubuntu1
None known
docker.io-app
Ubuntu:26.04:LTS
All versions, plus listed versions
28.2.2-0ubuntu129.1.2-0ubuntu129.1.3-0ubuntu129.1.3-0ubuntu229.1.3-0ubuntu329.1.3-0ubuntu429.1.3-0ubuntu4.1
None known

What each source reports

CVE List Score used4.5

Malicious client could set xattr value outside of BuildKit state directory

In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.

Record
CVE-2026-121520
CVSS 4.0
4.5 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H
Weakness
CWE-61
Updated
2026-11-06
EUVDEUVD-2026-1165384.5

In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.

Record
EUVD-2026-116538
CVSS 4.0
4.5 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H
Updated
2026-11-06
NVD4.5

In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.

Record
CVE-2026-121520
CVSS 4.0
4.5 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-61
Updated
2026-11-06
OSV4.5

Malicious client could set xattr value outside of BuildKit state directory

In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.

Record
CVE-2026-121520
CVSS 4.0
4.5 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H
Weakness
CWE-61
Updated
2026-11-07
OSVRHSA-2026:956117.9

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:95611
CVSS 3.1
7.9 HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
Updated
2026-11-13
OSVUBUNTU-CVE-2026-1215204.5

In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.

Record
UBUNTU-CVE-2026-121520
CVSS 4.0
4.5 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H
Updated
2026-11-05
OSVAZL-112726No score

CVE-2026-121520 affecting package docker-buildx 0.14.0-20

In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.

Record
AZL-112726
Updated
2026-11-13
OSVAZL-112729No score

CVE-2026-121520 affecting package docker-compose 2.27.0-17

In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.

Record
AZL-112729
Updated
2026-11-13
OSVAZL-112756No score

CVE-2026-121520 affecting package moby-engine 25.0.18-2

In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.

Record
AZL-112756
Updated
2026-11-13

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affectedOSV
affected, aliases, referencesCVE List, EUVD, NVD, OSV
affected, aliases, referencesOSV
referencesOSV
aliases, referencesNVD, OSV
first indexedCVE List, EUVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 11 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open