Moby Buildkit
12 CVEs affecting Moby Buildkit. Latest disclosed: 2026-07-21. Critical: 2, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-23652 | Critical | 10.0 | 2024-01-31 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerf… |
CVE-2024-23653 | Critical | 9.8 | 2024-01-31 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as bui… |
CVE-2024-23651 | High | 8.7 | 2024-01-31 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Two malicious build steps running in par… |
CVE-2026-33747 | High | 8.4 | 2026-03-27 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a cu… |
CVE-2026-33748 | High | 7.5 | 2026-03-27 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient va… |
CVE-2023-26054 | Medium | 6.5 | 2023-03-06 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In affected versions when the user sends… |
CVE-2024-23650 | Medium | 5.3 | 2024-01-31 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend… |
CVE-2026-15793 | | 2026-07-21 | BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious… | |
CVE-2026-15792 | | 2026-07-21 | A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. | |
CVE-2026-15791 | | 2026-07-21 | A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete… | |
CVE-2026-15789 | | 2026-07-21 | A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs… | |
CVE-2026-15788 | | 2026-07-20 | BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root. A… |