Moby Buildkit vulnerabilities

• moby buildkit Malicious client could set xattr value outside of BuildKit state directory CVE-2026-121520 4.5 MediumNovember 3, 2026
• moby buildkit Possible panic from Git source resolver CVE-2026-121522 6.7 MediumNovember 3, 2026
• moby buildkit Malformed LLB file operation can crash buildkitd CVE-2026-93321 Fix available 6.9 MediumOctober 5, 2026
• moby buildkit BuildKit proxy CA cleanup can be disrupted by build steps CVE-2026-93315 Fix available 5.8 MediumOctober 5, 2026
• moby buildkit Crafted Git build source can bypass certain policy validation CVE-2026-93326 Fix available 6.0 MediumOctober 5, 2026
• moby buildkit Oversized Dockerfile or .dockerignore can exhaust buildkitd memory CVE-2026-93323 Fix available 6.8 MediumOctober 5, 2026
• moby buildkit Malformed MergeOp can crash the BuildKit daemon CVE-2026-93322 6.9 MediumOctober 5, 2026
• moby buildkit BuildKit improperly handles special files in build snapshots CVE-2026-93320 6.0 MediumOctober 5, 2026
• moby buildkit A malicious frontend can cause a daemon panic CVE-2026-93319 5.7 MediumOctober 5, 2026
• moby buildkit Cache poisoning via unvalidated image layer DiffIDs CVE-2026-93318 7.5 HighOctober 5, 2026
• moby buildkit Container blob cache can accept unverified content CVE-2026-93317 5.9 MediumOctober 5, 2026
• moby buildkit Starting daemon with --cdi-disabled flag can lead to panic on specific builds CVE-2026-93316 7.1 HighOctober 5, 2026
• moby buildkit BuildKit < 1.0.29 - Contributor+ Stored SQLi via list_content Parameter CVE-2026-94298 6.2 MediumOctober 2, 2026
• moby buildkit BuildKit: Custom frontend could bypass Seccomp/AppArmor CVE-2026-61711 Fix available 5.3 MediumAugust 19, 2026
• moby buildkit BuildKit: Possible runtime DoS via unbounded group parsing CVE-2026-61712 Fix available 2.3 LowAugust 3, 2026
• moby buildkit Possible panic when incorrect parameters sent from frontend CVE-2026-15792 6.3 MediumJuly 21, 2026
• moby buildkit BuildKit: Malicious client can bypass destination directory validation on local sources upload CVE-2026-75593 Fix available 7.2 HighJuly 21, 2026
• moby buildkit LLB file operation can be tricked to remove /tmp directory contents CVE-2026-15791 3.3 LowJuly 21, 2026
• moby buildkit Malicious client can bypass destination directory validation on local sources upload CVE-2026-15789 Fix available 6.9 MediumJuly 21, 2026
• moby buildkit Git source checkout from a bundle file could lead to command injection CVE-2026-15793 6.5 MediumJuly 21, 2026
• moby buildkit WCOW cache mount source selector resolves NTFS junctions outside of cache root CVE-2026-15788 5.6 MediumJuly 20, 2026
• moby buildkit BuildKit Git URL subdir component can cause access to restricted files CVE-2026-33748 Fix available 8.2 HighMarch 26, 2026
• moby buildkit BuildKit vulnerable to malicious frontend causing file escape outside of storage root CVE-2026-33747 Fix available 8.4 HighMarch 26, 2026
• moby buildkit BuildKit interactive containers API does not validate entitlements check CVE-2024-23653 Public exploitFix available 9.8 CriticalJanuary 31, 2024
• moby buildkit BuildKit possible host system access from mount stub cleaner CVE-2024-23652 Public exploitFix available 10.0 CriticalJanuary 31, 2024
• moby buildkit BuildKit possible race condition with accessing subpaths from cache mounts CVE-2024-23651 Fix available 8.7 HighJanuary 31, 2024
• moby buildkit BuildKit possible panic when incorrect parameters sent from frontend CVE-2024-23650 Fix available 5.3 MediumJanuary 31, 2024
• moby buildkit Credentials inlined to Git URLs could end up in provenance attestation in BuildKit CVE-2023-26054 Fix available 6.5 MediumMarch 6, 2023