7.2
Élevée
CVE-2026-75593 BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner
Description
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access BuildKit control API to issue builds, eg., bypass authentication, etc. This issue is fixed in version 0.31.2.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| buildkit 0.31 | premières → < 0.31.2 | 0.31.2 |
Références
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de buildkit
Les 27 CVE de buildkit →
CVE-2026-121520
Malicious client could set xattr value outside of BuildKit state directory
4.5
Moyenne
CVE-2026-121522
Possible panic from Git source resolver
6.7
Moyenne
CVE-2026-93321
A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all…
6.9
Moyenne
CVE-2026-93315
When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup
5.8
Moyenne