CVE-2026-121520
Malicious client could set xattr value outside of BuildKit state directory
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.
| CWE | CWE-61 |
| Vendor | moby |
| Product | buildkit |
| Published | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for moby buildkit
Be the first to know when new unknown vulnerabilities affecting moby buildkit are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Moby / BuildKit
0 < 0.34.1