{"id":"CVE-2026-121522","kind":"vulnerability","aliases":["CVE-2026-121522"],"related":[],"title":"BuildKit: a build definition can crash the build daemon via Git metadata","description":"In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2.","summary":"BuildKit versions v0.26.0 through v0.34.1 panic and crash when a specific build definition resolves metadata for the same Git source reference twice. The crash interrupts builds handled by that daemon.","severity":"medium","cvss":6.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["buildkit","ci","docker","infrastructure","self-hosted"],"not_affected_if":["no-git-sources","version-outside-range"],"how_to_check":"- Run `buildkitd --version` or `docker buildx version` on the build host to see the BuildKit version.\n- Check whether the version falls in v0.26.0 through v0.34.1.","fix":"- BuildKit: move to `v0.34.2`","status":"open","published_at":"2026-11-03T22:19:46+00:00","first_seen_at":"2026-11-03T23:15:08+00:00","triaged_at":"2026-11-03T23:16:14+00:00","updated_at":"2026-11-03T23:16:14+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-03T23:16:14Z","model":"claude-haiku-5-5","output":{"fix":"- BuildKit: move to `v0.34.2`","reach":"unknown","title":"BuildKit: a build definition can crash the build daemon via Git metadata","impact":"low","summary":"BuildKit versions v0.26.0 through v0.34.1 panic and crash when a specific build definition resolves metadata for the same Git source reference twice. The crash interrupts builds handled by that daemon.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["buildkit","docker","ci","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Build daemon crashes, interrupting builds it is handling","analyst_note":"","how_to_check":"- Run `buildkitd --version` or `docker buildx version` on the build host to see the BuildKit version.\n- Check whether the version falls in v0.26.0 through v0.34.1.","plain_action":"","needs_analyst":false,"not_affected_if":["version-outside-range","no-git-sources"],"who_is_affected":"Teams that run a BuildKit daemon, including self-hosted build servers and CI runners, and that build from Git sources. Hosts on versions outside v0.26.0 through v0.34.1 are not affected. Builds that do not resolve Git sources do not reach the flawed path, as the description ties the crash to a Git source reference.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000673,"input_tokens":4139,"output_tokens":518,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121522':15A,18A '-2026':14A,17A 'build':3A,8A,37B,51B,64C,86C 'buildkit':1A,19B,26B,57C,79C 'caus':77C 'ci':20B 'crash':6A,33B,49B,84C 'cve':13A,16A 'daemon':9A,55B,80C,90C 'definit':4A,38B,65C 'docker':21B 'fix':94C 'git':11A,44B,72C 'handl':52B,87C 'host':25B 'infrastructur':22B 'interrupt':50B,85C 'issu':92C 'metadata':12A,40B,68C 'panic':31B,82C 'refer':46B,74C 'resolv':39B,67C 'self':24B 'self-host':23B 'sourc':45B,73C 'specif':36B,63C 'twice':47B,75C 'v0.26.0':28B,59C 'v0.34.1':30B,61C 'v0.34.2':96C 'version':27B,58C 'via':10A","nicknames":[],"mitigations":[],"who_affected":"Teams that run a BuildKit daemon, including self-hosted build servers and CI runners, and that build from Git sources. Hosts on versions outside v0.26.0 through v0.34.1 are not affected. Builds that do not resolve Git sources do not reach the flawed path, as the description ties the crash to a Git source reference.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["buildkit","ci","docker","infrastructure","medium","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-03T19:24:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@docker.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121522","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121522","severity":null,"published_at":"2026-11-03T22:19:46+00:00","modified_at":"2026-11-03T22:19:46+00:00","first_seen_at":"2026-11-03T23:15:08+00:00","fetched_at":"2026-11-03T23:15:08+00:00","note":null}],"documents":[{"id":61388,"url":"https://github.com/moby/buildkit/security/advisories/GHSA-2fqp-xg6f-v7gj","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-03T19:24:19+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}