Medium [CVE-2026-121520] In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory
This medium-severity Docker advisory covers CVE-2026-121520 affecting BuildKit.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Get an email when Docker BuildKit / Compose publishes the next one.
See Docker BuildKit / Compose's last 90 days of advisories first. Then choose the free weekly digest, or a free month of real-time alerts with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
Summary
In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges.
This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.
- before 0.34.1
NVD record · high-confidence parse· fetched 1 day ago·verify at source
Mitigation
Upgrade to a fixed release: 0.34.1. That is the remediation for this advisory.
The vendor advisory may list interim mitigations or workarounds not captured here. Review it before change work.
NVD record · high-confidence parse· fetched 1 day ago·verify at source
More Docker advisories
- CVE-2026-121522Nov 3, 2026In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves
- CVE-2026-93321Oct 5, 2026Docker: malicious frontend can submit an LLB definition that causes buildkitd to panic
- CVE-2026-93315Oct 5, 2026Docker: When proxy networking with CA injection is enabled, a build can modify its CA
- CVE-2026-93326Oct 5, 2026Docker: build step for a Git source, crafted in a specific way, can bypass some policy
- CVE-2026-93323Oct 5, 2026The Dockerfile frontend loaded the Dockerfile and.dockerignore files of a build context
- CVE-2026-93322Oct 5, 2026Docker: malicious frontend can submit an LLB definition that causes buildkitd to panic
Android app · Google Play
Monitor future Docker CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.