CVE-2026-121520 PUBLISHED

Malicious client could set xattr value outside of BuildKit state directory

Assigner: Docker
Reserved: 03.11.2026 Published: 03.11.2026 Updated: 03.11.2026

In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H
CVSS Score: 4.5

Host security-label modification

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Local	Confidentiality	None	Confidentiality	None
Attack Complexity	Low	Integrity	None	Integrity	High
Attack Requirements	Present	Availability	None	Availability	High
Privileges Required	High
User Interaction	None

Host security-label modification

CVSS 4.0

Product Status

Vendor	Moby
Product	BuildKit
Versions	Default: unaffected affected from 0 to 0.34.1 (excl.)

Workarounds

Restrict access to BuildKit control APIs to trusted clients and do not accept build requests from untrusted users.

Solutions

Upgrade BuildKit to v0.34.1 or later.

References

https://github.com/moby/buildkit/security/advisories/GHSA-w26x-xg27-7qjc

Problem Types

CWE-61: UNIX Symbolic Link (Symlink) Following CWE