Moby Buildkit
27 CVEs affecting Moby Buildkit. Latest disclosed: 2026-11-03. Critical: 2, High: 8.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-23652 | Critical | 10.0 | 2024-01-31 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerf… |
CVE-2024-23653 | Critical | 9.8 | 2024-01-31 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as bui… |
CVE-2024-23651 | High | 8.7 | 2024-01-31 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Two malicious build steps running in par… |
CVE-2026-33747 | High | 8.4 | 2026-03-27 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a cu… |
CVE-2026-15793 | High | 7.5 | 2026-07-21 | BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious… |
CVE-2026-15792 | High | 7.5 | 2026-07-21 | A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. |
CVE-2026-15791 | High | 7.5 | 2026-07-21 | A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete… |
CVE-2026-15789 | High | 7.5 | 2026-07-21 | A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs… |
CVE-2026-15788 | High | 7.5 | 2026-07-20 | BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root. A… |
CVE-2026-33748 | High | 7.5 | 2026-03-27 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient va… |
CVE-2023-26054 | Medium | 6.5 | 2023-03-06 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In affected versions when the user sends… |
CVE-2024-23650 | Medium | 5.3 | 2024-01-31 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend… |
CVE-2026-121520 | | 2026-11-03 | In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute o… | |
CVE-2026-121522 | | 2026-11-03 | In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit… | |
CVE-2026-93321 | | 2026-10-05 | A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon. | |
CVE-2026-93315 | | 2026-10-05 | When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build… | |
CVE-2026-93326 | | 2026-10-05 | A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look li… | |
CVE-2026-93323 | | 2026-10-05 | The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing an oversi… | |
CVE-2026-93322 | | 2026-10-05 | A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon. | |
CVE-2026-93320 | | 2026-10-05 | BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootf… |