Description
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access BuildKit control API to issue builds, eg., bypass authentication, etc. This issue is fixed in version 0.31.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| moby | buildkit | < 0.31.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | buildah | 1.45.0-2.hum1 | RHSA-2026:51065 |
| Red Hat Hardened Images 1 | podman +4 | 6.0.2-2.2.hum1 | RHSA-2026:52807 |
| Red Hat Hardened Images 1 | trivy | 0.73.0-0.1.hum1 | RHSA-2026:50953 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | runfinch-finch | 1.19.0-1.amzn2023.0.1 | ALAS2023-2026-3140 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | moby-engine | 25.0.3-20 | — |
Advisories 5
- WID-SEC-2026-2111 docker: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- RHSA-2026:52807 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:51065 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:50953 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- ALAS2023-2026-3140 Important: runfinch-finch security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 28, 2026