GitHub Advisoryadvisory · Go

GHSA-7236-3392-c5c6 BuildKit: Custom frontend could bypass Seccomp/AppArmor

MEDIUM Published 2026-08-19 Modified 2026-08-19 Official page ↗
Aliases
CVE-2026-61711
Ecosystem
Go
Packages
github.com/moby/buildkit
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-20
Reviewed
2026-08-19

Affected packages

• Go github.com/moby/buildkit: < 0.31.1 → fixed in 0.31.1

Description

Impact A custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the `security.insecure` entitlement. Other security measures, like Linux capabilities were still applied to these containers. Patches Problem has been fixed in versions v0.31.1+ Workarounds Only use BuildKit frontends from trusted providers.

Related

Alias · CVE (1)

  • CVE-2026-61711 BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References