BuildKit vulnerable to malicious frontend causing file escape outside of storage root

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-33747 · CVE overview and exploitation status

EUVD-2026-16518

GHSA-4c29-8rgm-jvjj

GO-2026-4858

cve-program · CVE-2026-33747

• https://github.com/moby/buildkit/security/advisories/GHSA-4c29-8rgm-jvjj
• https://github.com/moby/buildkit/releases/tag/v0.28.1

euvd · EUVD-2026-16518

• https://github.com/moby/buildkit/security/advisories/GHSA-4c29-8rgm-jvjj
• https://github.com/moby/buildkit/releases/tag/v0.28.1

nvd · CVE-2026-33747

• https://github.com/moby/buildkit/releases/tag/v0.28.1
• https://github.com/moby/buildkit/security/advisories/GHSA-4c29-8rgm-jvjj

osv · GHSA-4c29-8rgm-jvjj

• https://github.com/moby/buildkit/security/advisories/GHSA-4c29-8rgm-jvjj
• https://nvd.nist.gov/vuln/detail/CVE-2026-33747
• https://github.com/moby/buildkit
• https://github.com/moby/buildkit/releases/tag/v0.28.1

osv · GO-2026-4858

• https://github.com/moby/buildkit/security/advisories/GHSA-4c29-8rgm-jvjj
• https://github.com/moby/buildkit/releases/tag/v0.28.1

• BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft an API message that causes files t… · Advisory content revised · 1 Nov 2026