4.5 Medium

CVE-2026-121520 Malicious client could set xattr value outside of BuildKit state directory

Description

In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.

CVSS 4.0 detail

CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H

Exploitable with local access to the machine, with an administrator account and without any user action; with no direct impact on the vulnerable system.

Attack vector: Local
Attack complexity: Low
Attack requirements: Present
Privileges required: High
Interaction: None
Confidentiality: None
Integrity: None
Availability: None
Confidentiality of other systems: None
Integrity of other systems: High
Availability of other systems: High

Affected products and versions

Product	Affected versions	Fixed in
buildkit 0.34	earliest → < 0.34.1	0.34.1

References

github.com github.com

Timeline

Published November 3, 2026
Last modified November 3, 2026

The 27 CVEs of buildkit →

CVE-2026-121522 Possible panic from Git source resolver 6.7 Medium CVE-2026-93321 A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all… 6.9 Medium CVE-2026-93315 When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup 5.8 Medium CVE-2026-93326 A build step for a Git source, crafted in a specific way, can bypass some policy validation rules 6.0 Medium

Track this CVE