Product by Go

    Github.com/moby/buildkit

    9 known vulnerabilities in Github.com/moby/buildkit (Go), 0 of them actively exploited (CISA KEV).

    Key figures

    9

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    3

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Github.com/moby/buildkit (Go)
    CriticalCVE-2024-23653

    BuildKit interactive containers API does not validate entitlements check

    also in 2 other products

    		9.8
    CriticalCVE-2024-23652

    BuildKit possible host system access from mount stub cleaner

    also in 2 other products

    		10.0
    HighCVE-2024-23651

    BuildKit possible race condition with accessing subpaths from cache mounts

    also in 2 other products

    		8.7
    CriticalCVE-2026-33747

    BuildKit vulnerable to malicious frontend causing file escape outside of storage root

    also in 3 other products

    		8.4
    HighCVE-2026-33748

    BuildKit Git URL subdir component can cause access to restricted files

    also in 3 other products

    		7.5
    MediumCVE-2023-26054

    Credentials inlined to Git URLs could end up in provenance attestation in BuildKit

    also in 2 other products

    		6.5
    MediumCVE-2024-23650

    BuildKit possible panic when incorrect parameters sent from frontend

    also in 2 other products

    		5.3
    MediumCVE-2026-61711

    BuildKit: Custom frontend could bypass Seccomp/AppArmor

    also in 2 other products

    		—
    LowCVE-2026-61712

    BuildKit: Possible runtime DoS via unbounded group parsing

    also in 2 other products

    		—

    All products by Go