Product by Mobyproject
BuildKit
12 known vulnerabilities in BuildKit (Mobyproject), 0 of them actively exploited (CISA KEV).
Key figures
12
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2024-23653 | BuildKit interactive containers API does not validate entitlements check | 9.8 | |
| Critical | CVE-2024-23652 | BuildKit possible host system access from mount stub cleaner | 10.0 | |
| High | CVE-2024-23651 | BuildKit possible race condition with accessing subpaths from cache mounts | 8.7 | |
| Critical | CVE-2026-33747 | BuildKit vulnerable to malicious frontend causing file escape outside of storage root | 8.4 | |
| High | CVE-2026-33748 | BuildKit Git URL subdir component can cause access to restricted files | 7.5 | |
| High | CVE-2026-15788 | WCOW cache mount source selector resolves NTFS junctions outside of cache root | 7.5 | |
| Medium | CVE-2023-26054 | Credentials inlined to Git URLs could end up in provenance attestation in BuildKit | 6.5 | |
| Medium | CVE-2024-23650 | BuildKit possible panic when incorrect parameters sent from frontend | 5.3 | |
| High | CVE-2026-15789 | Malicious client can bypass destination directory validation on local sources upload | 7.5 | |
| High | CVE-2026-15791 | LLB file operation can be tricked to remove /tmp directory contents | 7.5 | |
| High | CVE-2026-15792 | Possible panic when incorrect parameters sent from frontend | 7.5 | |
| High | CVE-2026-15793 | Git source checkout from a bundle file could lead to command injection | 7.5 |