Security Bypass in BuildKit Tool by Moby Technologies
CVE-2026-61711

5.3MEDIUM

Key Information:

Vendor

Moby

Status
Buildkit
Vendor
CVE Published:
19 August 2026

What is CVE-2026-61711?

A security bypass vulnerability in BuildKit allows a crafted build request to disable Seccomp and AppArmor protections within build containers. Prior to version 0.31.1, when an unsupported SecurityMode value was submitted, the system treated it as a non-sandbox mode without enforcing necessary security entitlements. This misconfiguration increases the risk of exposure to malicious code execution, despite Linux capabilities still being restricted. The issue has been addressed in version 0.31.1.

Affected Version(s)

buildkit < 0.31.1

References

https://github.com/moby/buildkit/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/moby/buildkit/commit/3ea6dd0ce7d269cdb...
x_refsource_MISC
https://github.com/moby/buildkit/commit/64bbec89ca43dd95b...
x_refsource_MISC

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.