Description
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context. The issue has been fixed in v0.28.1. The vulnerability requires using an untrusted BuildKit frontend set with `#syntax` or `--build-arg BUILDKIT_SYNTAX`. Using these options with a well-known frontend image like `docker/dockerfile` is not affected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| moby | buildkit | < 0.28.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | docker.io | 28.5.2+dfsg4-3 | — |
| Debian 13 | docker.io | 26.1.5+dfsg1-9+deb13u1 | — |
| Debian 12 | docker.io | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | docker.io | No fix yet | — |
| Ubuntu 26.10 | docker.io-app | 29.1.3-0ubuntu5 | — |
| Ubuntu 26.04 LTS | docker.io | No fix yet | — |
| Ubuntu 26.04 LTS | docker.io-app | 29.1.3-0ubuntu4.1 | — |
| Ubuntu 25.10 | docker.io +1 | No fix yet | — |
| Ubuntu 24.04 LTS | docker.io-app | 29.1.3-0ubuntu3~24.04.2 | — |
| Ubuntu 22.04 LTS | docker.io-app | 29.1.3-0ubuntu3~22.04.2 | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | docker.io | No fix yet | — |
| Ubuntu Pro 22.04 LTS | docker.io | No fix yet | — |
| Ubuntu Pro 20.04 LTS | docker.io | No fix yet | — |
| Ubuntu Pro 20.04 LTS | docker.io-app | 26.1.3-0ubuntu1~20.04.1+esm2 | — |
| Ubuntu Pro 18.04 LTS | docker.io | No fix yet | — |
| Ubuntu Pro 16.04 LTS | docker.io | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | docker-stable | 24.0.9_ce-1.37.1 | SUSE-SU-2026:2578-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | conftest | 0.67.1-2.1 | openSUSE-SU-2026:10472-1 |
| openSUSE Tumbleweed | docker-stable | 24.0.9_ce-18.1 | openSUSE-SU-2026:11075-1 |
| openSUSE Tumbleweed | tailscale | 1.96.4-1.1 | openSUSE-SU-2026:10456-1 |
| openSUSE Tumbleweed | trivy | 0.70.0-1.1 | openSUSE-SU-2026:10651-1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
| openSUSE Leap 16.0 | tailscale | 1.104.1-bp160.1.1 | openSUSE-SU-2026:22203-1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20260402T184258-150000.1.158.1 | SUSE-SU-2026:1205-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | buildkit | 0.29.0-r0 | — |
| Alpine v3.24 | docker | 29.3.1-r0 | — |
| Alpine v3.23 | docker | 29.3.1-r0 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | buildah | 1.44.0-r0 | — |
| Wolfi rolling | conftest | 0.67.1-r2 | — |
| Wolfi rolling | docker-cli-buildx | 0.32.1-r3 | — |
| Wolfi rolling | docker-compose | 5.1.1-r1 | — |
| Wolfi rolling | dockerd-28 | No fix yet | — |
| Wolfi rolling | guac +2 | 1.1.0-r2 | — |
| Wolfi rolling | kaniko +1 | 1.25.12-r1 | — |
| Wolfi rolling | kubescape | 4.0.5-r0 | — |
| Wolfi rolling | osv-scanner | 2.3.6-r0 | — |
| Wolfi rolling | podman | 6.0.0-r0 | — |
| Wolfi rolling | scorecard | 5.4.0-r15 | — |
| Wolfi rolling | skaffold | 2.18.2-r1 | — |
| Wolfi rolling | trivy | 0.69.3-r6 | — |
| Wolfi rolling | trivy-operator | 0.30.1-r4 | — |
| Wolfi rolling | zot | 2.1.15-r4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/moby/buildkit | < 0.28.1 | 0.28.1 | GHSA-4c29-8rgm-jvjj |
Advisories 9
- openSUSE-SU-2026:22203-1 Security update for tailscale SUSE / openSUSE Security Updates · Oct 31, 2026
- WID-SEC-2026-0873 docker: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 22, 2026
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- SUSE-SU-2026:2578-1 Security update for docker-stable SUSE / openSUSE Security Updates · Jun 24, 2026
- openSUSE-SU-2026:11075-1 docker-stable-24.0.9_ce-18.1 on GA media SUSE / openSUSE Security Updates · Jun 24, 2026
- openSUSE-SU-2026:10651-1 trivy-0.70.0-1.1 on GA media SUSE / openSUSE Security Updates · Apr 29, 2026
- SUSE-SU-2026:1205-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Apr 8, 2026
- openSUSE-SU-2026:10472-1 conftest-0.67.1-2.1 on GA media SUSE / openSUSE Security Updates · Apr 2, 2026
- openSUSE-SU-2026:10456-1 tailscale-1.96.4-1.1 on GA media SUSE / openSUSE Security Updates · Mar 29, 2026