CVE-2026-61711: falha de média gravidade em moby buildkit
BuildKit: Custom frontend could bypass Seccomp/AppArmor
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.4%
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/spec_linux.go treated the unsupported value as a non-sandbox mode without requiring the security.insecure entitlement. This disabled Seccomp and AppArmor protections for the build container even though Linux capabilities remained restricted. This issue is fixed in version 0.31.1.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Produtos afetados
moby · buildkitCVEs relacionadas — moby buildkit
No mesmo produto, das mais perigosas para as menos.
CVE-2024-23653CRITICALBuildKit interactive containers API does not validate entitlements checkEPSS 3.4%CVE-2024-23652CRITICALBuildKit possible host system access from mount stub cleanerEPSS 2.5%CVE-2024-23650MEDIUMBuildKit possible panic when incorrect parameters sent from frontendEPSS 1.1%CVE-2023-26054MEDIUMCredentials inlined to Git URLs could end up in provenance attestation in BuildKitEPSS 1.0%CVE-2024-23651HIGHBuildKit possible race condition with accessing subpaths from cache mountsEPSS 0.9%CVE-2026-75593HIGHBuildKit: Malicious client can bypass destination directory validation on local sources uploadEPSS 0.5%