Mobyproject Buildkit vulnerabilities

• moby buildkit Possible panic when incorrect parameters sent from frontend CVE-2026-15792 6.3 MediumJuly 21, 2026
• moby buildkit LLB file operation can be tricked to remove /tmp directory contents CVE-2026-15791 3.3 LowJuly 21, 2026
• moby buildkit Malicious client can bypass destination directory validation on local sources upload CVE-2026-15789 Fix available 6.9 MediumJuly 21, 2026
• moby buildkit Git source checkout from a bundle file could lead to command injection CVE-2026-15793 6.5 MediumJuly 21, 2026
• moby buildkit WCOW cache mount source selector resolves NTFS junctions outside of cache root CVE-2026-15788 5.6 MediumJuly 20, 2026
• moby buildkit BuildKit Git URL subdir component can cause access to restricted files CVE-2026-33748 Fix available 8.2 HighMarch 26, 2026
• moby buildkit BuildKit vulnerable to malicious frontend causing file escape outside of storage root CVE-2026-33747 Fix available 8.4 HighMarch 26, 2026
• moby buildkit BuildKit interactive containers API does not validate entitlements check CVE-2024-23653 Public exploitFix available 9.8 CriticalJanuary 31, 2024
• moby buildkit BuildKit possible host system access from mount stub cleaner CVE-2024-23652 Public exploitFix available 10.0 CriticalJanuary 31, 2024
• moby buildkit BuildKit possible race condition with accessing subpaths from cache mounts CVE-2024-23651 Fix available 8.7 HighJanuary 31, 2024
• moby buildkit BuildKit possible panic when incorrect parameters sent from frontend CVE-2024-23650 Fix available 5.3 MediumJanuary 31, 2024
• moby buildkit Credentials inlined to Git URLs could end up in provenance attestation in BuildKit CVE-2023-26054 Fix available 6.5 MediumMarch 6, 2023