---
id: "CVE-2026-121522"
kind: "vulnerability"
aliases: ["CVE-2026-121522"]
title: "BuildKit: a build definition can crash the build daemon via Git metadata"
severity: "medium"
cvss: 6.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["buildkit", "ci", "docker", "infrastructure", "self-hosted"]
not_affected_if: ["no-git-sources", "version-outside-range"]
published_at: "2026-11-03T22:19:46+00:00"
first_seen_at: "2026-11-03T23:15:08+00:00"
updated_at: "2026-11-03T23:16:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121522", "first_seen_at": "2026-11-03T23:15:08+00:00"}]
---

# BuildKit: a build definition can crash the build daemon via Git metadata

BuildKit versions v0.26.0 through v0.34.1 panic and crash when a specific build definition resolves metadata for the same Git source reference twice. The crash interrupts builds handled by that daemon.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `buildkitd --version` or `docker buildx version` on the build host to see the BuildKit version.
- Check whether the version falls in v0.26.0 through v0.34.1.

## Fix

- BuildKit: move to `v0.34.2`

## Timeline

- 2026-11-03T23:15:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121522

## Documents

- [advisory] Vendor advisory: github.com https://github.com/moby/buildkit/security/advisories/GHSA-2fqp-xg6f-v7gj

## From the sources

In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_