What’s Vulnerable › Products
moby BuildKit vulnerabilities
25 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 20 published in the last 12 months.
Check whether your moby BuildKit version is affected
Latest moby BuildKit vulnerabilities
- CVE-2026-93321 — Malformed LLB file operation can crash buildkitd (CVSS 6.9)
- CVE-2026-93315 — BuildKit proxy CA cleanup can be disrupted by build steps (CVSS 5.8)
- CVE-2026-93326 — Crafted Git build source can bypass certain policy validation (CVSS 6.0)
- CVE-2026-93323 — Oversized Dockerfile or .dockerignore can exhaust buildkitd memory (CVSS 6.8)
- CVE-2026-93322 — Malformed MergeOp can crash the BuildKit daemon (CVSS 6.9)
- CVE-2026-93320 — BuildKit improperly handles special files in build snapshots (CVSS 6.0)
- CVE-2026-93319 — A malicious frontend can cause a daemon panic (CVSS 5.7)
- CVE-2026-93318 — Cache poisoning via unvalidated image layer DiffIDs (CVSS 7.5)
- CVE-2026-93317 — Container blob cache can accept unverified content (CVSS 5.9)
- CVE-2026-93316 — Starting daemon with --cdi-disabled flag can lead to panic on specific builds (CVSS 7.1)
- CVE-2026-75593 — BuildKit: Malicious client can bypass destination directory validation on local sources upload (CVSS 7.2)
- CVE-2026-61712 — BuildKit: Possible runtime DoS via unbounded group parsing (CVSS 2.3)
- CVE-2026-61711 — BuildKit: Custom frontend could bypass Seccomp/AppArmor (CVSS 5.3)
- CVE-2026-15793 — Git source checkout from a bundle file could lead to command injection (CVSS 7.5)
- CVE-2026-15792 — Possible panic when incorrect parameters sent from frontend (CVSS 7.5)
- CVE-2026-15791 — LLB file operation can be tricked to remove /tmp directory contents (CVSS 7.5)
- CVE-2026-15789 — Malicious client can bypass destination directory validation on local sources upload (CVSS 7.5)
- CVE-2026-15788 — WCOW cache mount source selector resolves NTFS junctions outside of cache root (CVSS 7.5)
- CVE-2026-33748 — BuildKit Git URL subdir component can cause access to restricted files (CVSS 7.5)
- CVE-2026-33747 — BuildKit vulnerable to malicious frontend causing file escape outside of storage root (CVSS 9.8)
- CVE-2024-23653 — BuildKit interactive containers API does not validate entitlements check (CVSS 9.8)
- CVE-2024-23652 — BuildKit possible host system access from mount stub cleaner (CVSS 9.1)
- CVE-2024-23651 — BuildKit possible race condition with accessing subpaths from cache mounts (CVSS 7.4)
- CVE-2024-23650 — BuildKit possible panic when incorrect parameters sent from frontend (CVSS 5.3)
- CVE-2023-26054 — Credentials inlined to Git URLs could end up in provenance attestation in BuildKit (CVSS 6.5)