Skip to content
OpenAdvisories

Package · Go

github.com/moby/buildkit

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

9 results · Feed

  • Medium 5.3
    CVE-2026-61711

    BuildKit: Custom frontend could bypass Seccomp/AppArmor

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/spec_linux.go trea…

    moby BuildKit github.com/moby/buildkit Go
  • Low 2.3
    CVE-2026-61712

    BuildKit: Possible runtime DoS via unbounded group parsing

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files without an upper bound while resolving a username to a u…

    moby BuildKit github.com/moby/buildkit Go
  • High 8.2
    CVE-2026-33748

    BuildKit Git URL subdir component can cause access to restricted files

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git…

    moby BuildKit docker.io docker.io Debian Ubuntu Alpine Go
  • High 8.4
    CVE-2026-33747

    BuildKit vulnerable to malicious frontend causing file escape outside of storage root

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outsid…

    moby BuildKit docker.io docker.io Debian Ubuntu Alpine Go
  • Critical 9.8
    CVE-2024-23653 Public exploit

    BuildKit interactive containers API does not validate entitlements check

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It w…

    moby BuildKit docker.io docker Ubuntu Alpine Go
  • Critical 10.0
    CVE-2024-23652 Public exploit

    BuildKit possible host system access from mount stub cleaner

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints i…

    moby BuildKit docker.io docker Ubuntu Alpine Go
  • High 8.7
    CVE-2024-23651

    BuildKit possible race condition with accessing subpaths from cache mounts

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Two malicious build steps running in parallel sharing the same cache mounts with subpaths could cause a race condition that can lead to file…

    moby BuildKit docker.io docker Ubuntu Alpine Go
  • Medium 5.3
    CVE-2024-23650

    BuildKit possible panic when incorrect parameters sent from frontend

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been f…

    moby BuildKit docker docker.io-app Ubuntu Alpine Go
  • Medium 6.5
    CVE-2023-26054

    Credentials inlined to Git URLs could end up in provenance attestation in BuildKit

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In affected versions when the user sends a build request that contains a Git URL that contains credentials and the build creates a provenanc…

    moby BuildKit docker github.com/moby/buildkit Alpine Go