Description
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/spec_linux.go treated the unsupported value as a non-sandbox mode without requiring the security.insecure entitlement. This disabled Seccomp and AppArmor protections for the build container even though Linux capabilities remained restricted. This issue is fixed in version 0.31.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| moby | buildkit | < 0.31.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | govulncheck-vulndb | 0.0.20260827T195228-160000.1.1 | SUSE-SU-2026:23625-1 |
| SLES 16.0 | govulncheck-vulndb | 0.0.20260827T195228-160000.1.1 | SUSE-SU-2026:23625-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260827T195228-160000.1.1 | openSUSE-SU-2026:21761-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | runfinch-finch | 1.19.0-1.amzn2023.0.1 | ALAS2023-2026-3140 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | moby-engine | 25.0.3-20 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | conftest | 0.69.0-r3 | — |
| Wolfi rolling | dockerd-28 | No fix yet | — |
| Wolfi rolling | guac +2 | 1.1.0-r28 | — |
| Wolfi rolling | kaniko +1 | 1.25.18-r4 | — |
| Wolfi rolling | kubescape | 4.0.12-r6 | — |
| Wolfi rolling | podman-6.0 | 6.0.2-r5 | — |
| Wolfi rolling | scorecard | 5.5.0-r17 | — |
| Wolfi rolling | skaffold | 2.24.0-r7 | — |
| Wolfi rolling | trivy | 0.74.0-r2 | — |
| Wolfi rolling | zot | 2.1.20-r4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/moby/buildkit | < 0.31.1 | 0.31.1 | GHSA-7236-3392-c5c6 |
Advisories 4
- WID-SEC-2026-2111 docker: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- SUSE-SU-2026:23625-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 29, 2026
- ALAS2023-2026-3140 Important: runfinch-finch security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 28, 2026
- openSUSE-SU-2026:21761-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 9, 2026