Docker BuildKit / Compose Vulnerabilities & Security Advisories

22 advisories tracked · Docker Security ([email protected] CNA) + NVD · 0 listed in the CISA Known Exploited Vulnerabilities catalog

Every row below is a published Docker advisory that VulniPulse classified as BuildKit / Compose, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 6 high, 14 medium, 2 low.

Source

Docker Security ([email protected] CNA) + NVD

Docker Inc. is its own CVE Numbering Authority. VulniPulse ingests Docker's CVEs from the NVD CNA feed ([email protected]) — Docker Desktop, Docker CLI, Docker Model Runner and Docker Sandboxes — and merges in the open-source engine components that publish under their own project CNAs (Moby, the Docker Engine upstream; BuildKit; containerd) via a subject-anchored NVD keyword feed that drops the heavy 'third-party app runs in a Docker Compose stack' noise. Fixes for CVEs another CNA assigned (for example a kernel CVE fixed in a Docker Desktop release) are read from Docker's security announcements page and dated by Docker's release notes. Docker Desktop / Engine is a near-universal part of every developer and homelab stack.

Visit Docker advisories Docker RSS feed

Latest Docker BuildKit / Compose advisories

All severities critical (0)high (6)medium (14)low (2)

High7.3Docker

High [CVE-2026-93325] Docker: Buildx bake requires the user to grant entitlements with --allow or an interactive prompt before a build reaches outside the working directory

Buildx bake requires the user to grant entitlements with --allow or an interactive prompt before a build reaches outside the working directory. Under --progress=rawjson that consent step is skipped. Affected product named by the advisory: Docker. Affected product named by the advisory: Docker Buildx.

Medium4.5Docker

Medium [CVE-2026-121520] In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory

In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.

Medium6.7Docker

Medium [CVE-2026-121522] In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon

In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2.

Medium5.6Docker

Medium [CVE-2026-121541] In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx client without the expected fs.read approval

In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, filesystem paths from some targets are not verified against the approved entitlements. Users who run untrusted Bake definitions may be affected. The issue is fixed in v0.38.1.

Low1.8Docker

Low [CVE-2026-121542] In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition may expose files accessible to the Buildx client without the expected fs.read approval

In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, paths under the same parent directory as the current working directory whose names use the working directory's basename as a prefix can skip the filesystem entitlement check. Exploitation requires specific matching filenames next to the current project directory. Users who run untrusted Bake definitions may be affected. The issue is fixed in v0.38.1.

High7.5Docker

High [CVE-2026-93318] BuildKit: malicious image can advertise DiffIDs from another image while containing different layer contents

A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents. If a BuildKit daemon with shared or persistent cache first processes such a malicious image, a later build using the victim image may mount the attacker-controlled layer contents as the base image. This can allow code from the malicious image to run in the victim build, for example by replacing a commonly executed path such as /bin/sh. The attacker-controlled code may read build secrets mounted into the build, access other build resources, alter output artifacts, or hang the build. The issue affects both regular snapshotters and lazy-pulling snapshotters such as stargz.

High7.1Docker

High [CVE-2026-93316] If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices

If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices. This can happen maliciously or by accident.

Medium6.9Docker

Medium [CVE-2026-93321] Docker: malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon. Affected product named by the advisory: Docker.

Medium5.8Docker

Medium [CVE-2026-93315] Docker: When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup

When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build. Affected product named by the advisory: Docker. Affected product named by the advisory: BuildKit.

Medium6.9Docker

Medium [CVE-2026-103433] Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs

Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after entitlement validation checks a different path representation. Users who run untrusted Bake definitions are affected.

Medium6.0Docker

Medium [CVE-2026-93326] Docker: build step for a Git source, crafted in a specific way, can bypass some policy validation rules

A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look like it is coming from a different remote URL than it really is when Git clone is happening. If policy is doing more stricter validation, for example based on commit SHA, commit data, or signatures, then all these validations still apply correctly. Affected product named by the advisory: Docker. Affected product named by the advisory: BuildKit.

Medium6.8Docker

Medium [CVE-2026-93323] The Dockerfile frontend loaded the Dockerfile and.dockerignore files of a build context into memory without a size limit

The Dockerfile frontend loaded the Dockerfile and.dockerignore files of a build context into memory without a size limit. A build context containing an oversized file could make buildkitd allocate memory proportional to that file, potentially exhausting memory and terminating the daemon, which interrupts other builds on the same instance. Fixed by rejecting such files above 16 MiB.

Medium6.0Docker

Medium [CVE-2026-93320] BuildKit may be tricked into performing file actions with special file inodes where regular files are expected

BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access.

Medium5.7Docker

Medium [CVE-2026-93319] malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic

A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic.

Medium5.9Docker

Medium [CVE-2026-93317] Docker: unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest

An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity. Affected product named by the advisory: Docker. Affected product named by the advisory: BuildKit.

High7.1Docker

High [CVE-2026-17106] The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process. Affected products named by the advisory: Docker Sandboxes; Docker Desktop; Docker Engine; Docker CLI; and 1 more. Affected products named by the advisory: Docker Compose.

High7.3Docker

High [CVE-2026-15793] BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources

BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host.

Medium6.0Docker

Medium [CVE-2026-15792] malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic

A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic.

Medium6.9Docker

Medium [CVE-2026-15789] custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc.

Low1.8Docker

Low [CVE-2026-15791] crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory

A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory.

Medium5.6Docker

Medium [CVE-2026-15788] BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root

BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root. A build authored by an untrusted user on a WCOW-configured BuildKit daemon can read arbitrary host files reachable to the BuildKit daemon process.

High8.2Docker

High [CVE-2026-33748] BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem. The issue has been fixed in version v0.28.1 The issue affects only builds that use Git URLs with a subpath component. As a workaround, avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.

Page 1 of 1 · showing 22 of 22

Get an email when Docker BuildKit / Compose publishes the next one.

See Docker BuildKit / Compose's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Docker BuildKit / Compose

iPhone and Android apps · New on the App Store

Monitor Docker BuildKit / Compose CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Get CVE alerts on Android See app features

← All Docker advisories