Live › vulnerability › CVE-2026-121520
A malicious client with access to BuildKit's control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Attributes in the trusted. or security. namespaces can also be set, which may give a host program elevated privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 23:45 UTC. All times on this page are UTC.
Only build services that accept build requests from untrusted users are described as exposed. A BuildKit deployment that only takes requests from trusted users is not described as exposed by the sources. unknown for anything beyond that.
No product ranges from the sources yet.
buildkitd --version or buildctl --versionv0.34.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-121520")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.