{"id":"CVE-2026-121520","published":"2026-11-03T23:17:34.177","lastModified":"2026-11-03T23:17:34.177","description":"In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-61"],"vendors":[],"products":[],"references":[{"url":"https://github.com/moby/buildkit/security/advisories/GHSA-w26x-xg27-7qjc","tags":[]}],"exploitRefs":[{"url":"https://github.com/moby/buildkit/security/advisories/GHSA-w26x-xg27-7qjc","tags":[]}],"hasPoc":true,"ai":null}