Unauthorized File Access Vulnerability in BuildKit by Moby
CVE-2026-121520

4.5MEDIUM

Key Information:

Vendor

Moby

Status
Buildkit
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121520?

BuildKit versions earlier than v0.34.1 are susceptible to a vulnerability where a malicious client can exploit control APIs to submit build requests. This could lead to the setting of malicious extended attributes on files outside the designated BuildKit state directory. These capabilities may allow elevated privileges for programs on the host, especially when build services are exposed to untrusted users. The issue was patched in version 0.34.1.

Affected Version(s)

BuildKit 0 < 0.34.1

References

https://github.com/moby/buildkit/security/advisories/GHSA...
vendor-advisory

CVSS V4

Score:
4.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.