6.7 Medium

CVE-2026-121522 Possible panic from Git source resolver

Description

In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2.

CVSS 4.0 detail

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Exploitable with local access to the machine, without an account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Local
Attack complexity: Low
Attack requirements: None
Privileges required: None
Interaction: Active
Confidentiality: None
Integrity: None
Availability: High
Confidentiality of other systems: None
Integrity of other systems: None
Availability of other systems: None

Affected products and versions

Product	Affected versions	Fixed in
buildkit 0.26	0.26.0 → < 0.34.2	0.34.2

References

github.com github.com

Timeline

Published November 3, 2026
Last modified November 3, 2026

The 27 CVEs of buildkit →

CVE-2026-121520 Malicious client could set xattr value outside of BuildKit state directory 4.5 Medium CVE-2026-93321 A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all… 6.9 Medium CVE-2026-93315 When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup 5.8 Medium CVE-2026-93326 A build step for a Git source, crafted in a specific way, can bypass some policy validation rules 6.0 Medium

Track this CVE