BuildKit: Custom frontend could bypass Seccomp/AppArmor

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-61711 · CVE overview and exploitation status

EUVD-2026-62838

GHSA-7236-3392-c5c6

GO-2026-6255

cve-program · CVE-2026-61711

• https://github.com/moby/buildkit/security/advisories/GHSA-7236-3392-c5c6
• https://github.com/moby/buildkit/commit/3ea6dd0ce7d269cdb8aa23348718e2c1bf64f109
• https://github.com/moby/buildkit/commit/64bbec89ca43dd95b2853edeca240c33c6729910
• https://github.com/moby/buildkit/releases/tag/v0.31.1

euvd · EUVD-2026-62838

• https://github.com/moby/buildkit/security/advisories/GHSA-7236-3392-c5c6
• https://github.com/moby/buildkit/commit/3ea6dd0ce7d269cdb8aa23348718e2c1bf64f109
• https://github.com/moby/buildkit/commit/64bbec89ca43dd95b2853edeca240c33c6729910
• https://github.com/moby/buildkit/releases/tag/v0.31.1

nvd · CVE-2026-61711

• https://github.com/moby/buildkit/commit/3ea6dd0ce7d269cdb8aa23348718e2c1bf64f109
• https://github.com/moby/buildkit/commit/64bbec89ca43dd95b2853edeca240c33c6729910
• https://github.com/moby/buildkit/releases/tag/v0.31.1
• https://github.com/moby/buildkit/security/advisories/GHSA-7236-3392-c5c6

osv · GHSA-7236-3392-c5c6

• https://github.com/moby/buildkit/security/advisories/GHSA-7236-3392-c5c6
• https://github.com/moby/buildkit

osv · GO-2026-6255

• https://github.com/moby/buildkit/security/advisories/GHSA-7236-3392-c5c6

• BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci… · Advisory content revised · 9 Nov 2026