Description
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem. The issue has been fixed in version v0.28.1 The issue affects only builds that use Git URLs with a subpath component. As a workaround, avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| moby | buildkit | < 0.28.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | docker.io | 28.5.2+dfsg4-3 | — |
| Debian 13 | docker.io | 26.1.5+dfsg1-9+deb13u1 | — |
| Debian 12 | docker.io | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | docker.io | No fix yet | — |
| Ubuntu 26.10 | docker.io-app | 29.1.3-0ubuntu5 | — |
| Ubuntu 26.04 LTS | docker.io | No fix yet | — |
| Ubuntu 26.04 LTS | docker.io-app | 29.1.3-0ubuntu4.1 | — |
| Ubuntu 25.10 | docker.io +1 | No fix yet | — |
| Ubuntu 24.04 LTS | docker.io-app | 29.1.3-0ubuntu3~24.04.2 | — |
| Ubuntu 22.04 LTS | docker.io-app | 29.1.3-0ubuntu3~22.04.2 | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | docker.io | No fix yet | — |
| Ubuntu Pro 22.04 LTS | docker.io | No fix yet | — |
| Ubuntu Pro 20.04 LTS | docker.io | No fix yet | — |
| Ubuntu Pro 20.04 LTS | docker.io-app | 26.1.3-0ubuntu1~20.04.1+esm2 | — |
| Ubuntu Pro 18.04 LTS | docker.io | No fix yet | — |
| Ubuntu Pro 16.04 LTS | docker.io | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | docker-stable | 24.0.9_ce-1.37.1 | SUSE-SU-2026:2578-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | docker-stable | 24.0.9_ce-18.1 | openSUSE-SU-2026:11075-1 |
| openSUSE Tumbleweed | trivy | 0.70.0-1.1 | openSUSE-SU-2026:10651-1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20260402T184258-150000.1.158.1 | SUSE-SU-2026:1205-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | buildkit | 0.29.0-r0 | — |
| Alpine v3.24 | docker | 29.3.1-r0 | — |
| Alpine v3.23 | docker | 29.3.1-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | runfinch-finch | 1.17.0-1.amzn2023.0.1 | ALAS2023-2026-1671 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | buildah | 1.44.0-r0 | — |
| Wolfi rolling | conftest | 0.67.1-r2 | — |
| Wolfi rolling | docker-cli-buildx | 0.32.1-r3 | — |
| Wolfi rolling | docker-compose | 5.1.1-r1 | — |
| Wolfi rolling | dockerd-28 | No fix yet | — |
| Wolfi rolling | guac +2 | 1.1.0-r2 | — |
| Wolfi rolling | kaniko +1 | 1.25.12-r1 | — |
| Wolfi rolling | kubescape | 4.0.5-r0 | — |
| Wolfi rolling | osv-scanner | 2.3.6-r0 | — |
| Wolfi rolling | podman | 6.0.0-r0 | — |
| Wolfi rolling | scorecard | 5.4.0-r15 | — |
| Wolfi rolling | skaffold | 2.18.2-r1 | — |
| Wolfi rolling | trivy | 0.69.3-r6 | — |
| Wolfi rolling | trivy-operator | 0.30.1-r4 | — |
| Wolfi rolling | zot | 2.1.15-r4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/moby/buildkit | < 0.28.1 | 0.28.1 | GHSA-4vrq-3vrq-g6gg |
Advisories 7
- WID-SEC-2026-0873 docker: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 22, 2026
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- SUSE-SU-2026:2578-1 Security update for docker-stable SUSE / openSUSE Security Updates · Jun 24, 2026
- openSUSE-SU-2026:11075-1 docker-stable-24.0.9_ce-18.1 on GA media SUSE / openSUSE Security Updates · Jun 24, 2026
- ALAS2023-2026-1671 Moderate: runfinch-finch security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 13, 2026
- openSUSE-SU-2026:10651-1 trivy-0.70.0-1.1 on GA media SUSE / openSUSE Security Updates · Apr 29, 2026
- SUSE-SU-2026:1205-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Apr 8, 2026