kritisch
CVE-2026-33747
BuildKit: github.com/moby/buildkit: BuildKit: Arbitrary file write and code execution via untrusted frontend
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA8.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.2CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut GHSA (hoch), Red Hat (mittel), Ubuntu (mittel).
Beschreibung
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context. The issue has been fixed in v0.28.1. The vulnerability requires using an untrusted BuildKit frontend set with `#syntax` or `--build-arg BUILDKIT_SYNTAX`. Using these options with a well-known frontend image like `docker/dockerfile` is not affected.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| alpine 3.23 | docker | 29.3.1-r0 |
| alpine 3.24 | buildkit, docker | 0.29.0-r0 und 1 weitere |
| alpine edge | buildkit, docker | 0.29.0-r0 und 1 weitere |
| chainguard | buildah, buildah-fips, cloudbeat-8.19 und 31 weitere | 1.44.0-r0 und 27 weitere |
| debian 11 | docker.io | kein Fix angegeben |
| debian 12 | docker.io | kein Fix angegeben |
| debian 13 | docker.io | 26.1.5+dfsg1-9+deb13u1 |
| debian 14 | docker.io | 28.5.2+dfsg4-3 |
| echo | docker.io | 26.1.5+dfsg1-9+deb13u1 |
| go::GitHub Security Advisory Go | github.com/moby/buildkit | 0.28.1 |
| minimos | buildah, buildah-fips, buildpacks-lifecycle-0.20 und 16 weitere | 1.44.1-r0 und 10 weitere |
| rapidfort alpine 3.20 | buildkit, docker | 0.29.0-r0 und 1 weitere |
Alle 116 Einträge aus 31 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| alpine 3.23 | docker | 29.3.1-r0 |
| alpine 3.24 | buildkit | 0.29.0-r0 |
| alpine 3.24 | docker | 29.3.1-r0 |
| alpine edge | buildkit | 0.29.0-r0 |
| alpine edge | docker | 29.3.1-r0 |
| chainguard | buildah | 1.44.0-r0 |
| chainguard | buildah-fips | 1.44.0-r0 |
| chainguard | cloudbeat-8.19 | 8.19.13-r2 |
| chainguard | cloudbeat-9.2 | 9.2.7-r2 |
| chainguard | cloudbeat-9.3 | 9.3.2-r1 |
| chainguard | cloudbeat-fips-8.19 | 8.19.13-r1 |
| chainguard | cloudbeat-fips-9.2 | 9.2.7-r3 |
| chainguard | cloudbeat-fips-9.3 | 9.3.2-r2 |
| chainguard | conftest | 0.67.1-r2 |
| chainguard | conftest-fips | 0.67.1-r1 |
| chainguard | docker-cli-buildx | 0.32.1-r3 |
| chainguard | docker-cli-buildx-fips | 0.32.1-r3 |
| chainguard | docker-compose | 5.1.1-r1 |
| chainguard | docker-compose-fips | 5.1.1-r1 |
| chainguard | docker-fips-29 | 29.5.2-r0 |
| chainguard | guac | 1.1.0-r2 |
| chainguard | kaniko | 1.25.12-r1 |
| chainguard | kaniko-fips | 1.25.12-r1 |
| chainguard | kubescape | 4.0.5-r0 |
| chainguard | kubescape-server | 4.0.3-r2 |
| chainguard | kubescape-server-fips | 4.0.3-r2 |
| chainguard | livekit-cli | 2.16.0-r4 |
| chainguard | osv-scanner | 2.3.6-r0 |
| chainguard | podman | 6.0.0-r0 |
| chainguard | podman-fips | 6.0.0-r0 |
| chainguard | podman-fips-5.8 | 0 |
| chainguard | scorecard | 5.4.0-r15 |
| chainguard | skaffold | 2.18.2-r1 |
| chainguard | skaffold-fips | 2.18.2-r0 |
| chainguard | trivy | 0.69.3-r6 |
| chainguard | trivy-fips | 0.69.3-r4 |
| chainguard | trivy-operator | 0.30.1-r4 |
| chainguard | trivy-operator-fips | 0.30.1-r3 |
| chainguard | zot | 2.1.15-r4 |
| debian 11 | docker.io | kein Fix angegeben |
| debian 12 | docker.io | kein Fix angegeben |
| debian 13 | docker.io | 26.1.5+dfsg1-9+deb13u1 |
| debian 14 | docker.io | 28.5.2+dfsg4-3 |
| echo | docker.io | 26.1.5+dfsg1-9+deb13u1 |
| go::GitHub Security Advisory Go | github.com/moby/buildkit | 0.28.1 |
| minimos | buildah | 1.44.1-r0 |
| minimos | buildah-fips | 1.44.1-r0 |
| minimos | buildpacks-lifecycle-0.20 | 0.20.20-r6 |
| minimos | buildpacks-lifecycle-fips-0.20 | 0.20.20-r5 |
| minimos | conftest | 0.67.1-r1 |
| minimos | conftest-fips | 0.67.1-r1 |
| minimos | datadog-agent | 7.65.1-r0 |
| minimos | docker-25 | 25.0.17-r0 |
| minimos | docker-29 | 29.3.1-r0 |
| minimos | docker-cli-buildx | 0.32.1-r2 |
| minimos | docker-cli-buildx-fips | 0.32.1-r2 |
| minimos | docker-compose | 5.1.1-r2 |
| minimos | docker-compose-fips | 5.1.1-r2 |
| minimos | docker-fips-25 | 25.0.17-r0 |
| minimos | docker-fips-29 | 29.3.1-r0 |
| minimos | livekit-cli | 2.16.0-r3 |
| minimos | livekit-cli-fips | 2.16.0-r3 |
| minimos | podman | 6.0.0-r0 |
| minimos | podman-fips | 6.0.0-r0 |
| rapidfort alpine 3.20 | buildkit | 0.29.0-r0 |
| rapidfort alpine 3.20 | docker | 29.3.1-r0 |
| rapidfort alpine 3.21 | buildkit | 0.29.0-r0 |
| rapidfort alpine 3.21 | docker | 29.3.1-r0 |
| rapidfort alpine 3.22 | buildkit | 0.29.0-r0 |
| rapidfort alpine 3.22 | docker | 29.3.1-r0 |
| rapidfort alpine 3.23 | buildkit | 0.29.0-r0 |
| rapidfort alpine 3.23 | docker | 29.3.1-r0 |
| rapidfort alpine 3.24 | buildkit | 0.29.0-r0 |
| rapidfort debian 12 | docker.io | 0:26.1.5+dfsg1-9+deb13u1, 0:28.5.2+dfsg4-3 |
| rapidfort debian 13 | docker.io | 0:26.1.5+dfsg1-9+deb13u1, 0:28.5.2+dfsg4-3 |
| rapidfort fedora 43 | docker-compose | 5.1.3-1.fc43 |
| rapidfort fedora 43 | doctl | 1.154.0-1.fc43 |
| rapidfort fedora 43 | moby-engine | 29.3.1-1.fc43 |
| rapidfort fedora 43 | moby-engine-nano | 29.3.1-1.fc43 |
| rapidfort fedora 43 | moby-filesystem | 29.3.1-1.fc43 |
| rapidfort fedora 43 | moby-rpm-macros | 29.3.1-1.fc43 |
| rapidfort ubuntu 20.04 | docker.io | 0:24.0.7-0ubuntu4 |
| rapidfort ubuntu 22.04 | docker.io | 0:24.0.7-0ubuntu4 |
| rapidfort ubuntu 24.04 | docker.io | 0:24.0.7-0ubuntu4 |
| Red Hat | openshift-kni/commatrix | kein Fix angegeben |
| Red Hat | openshift4/cnf-tests-rhel8 | kein Fix angegeben |
| Red Hat | openshift4/cnf-tests-rhel9 | kein Fix angegeben |
| Red Hat | openshift4/kube-compare-artifacts-rhel9 | kein Fix angegeben |
| Red Hat | openshift4/numaresources-must-gather-rhel9 | kein Fix angegeben |
| Red Hat | openshift4/ose-secrets-store-csi-mustgather-rhel9 | kein Fix angegeben |
| root.io debian 12 | rootio-docker.io | kein Fix angegeben |
| ubuntu 18.04-ESM | docker.io | kein Fix angegeben |
| ubuntu 20.04-ESM | docker.io | kein Fix angegeben |
| ubuntu 20.04-ESM | docker.io-app | 26.1.3-0ubuntu1~20.04.1+esm2 |
| ubuntu 22.04 | docker.io | kein Fix angegeben |
| ubuntu 22.04 | docker.io-app | 29.1.3-0ubuntu3~22.04.2 |
| ubuntu 24.04 | docker.io | kein Fix angegeben |
| ubuntu 24.04 | docker.io-app | 29.1.3-0ubuntu3~24.04.2 |
| ubuntu 26.04 | docker.io | kein Fix angegeben |
| ubuntu 26.04 | docker.io-app | 29.1.3-0ubuntu4.1 |
| ubuntu 26.10 | docker.io | kein Fix angegeben |
| ubuntu 26.10 | docker.io-app | 29.1.3-0ubuntu5 |
| wolfi | buildah | 1.44.0-r0 |
| wolfi | conftest | 0.67.1-r2 |
| wolfi | docker-cli-buildx | 0.32.1-r3 |
| wolfi | docker-compose | 5.1.1-r1 |
| wolfi | guac | 1.1.0-r2 |
| wolfi | kaniko | 1.25.12-r1 |
| wolfi | kubescape | 4.0.5-r0 |
| wolfi | osv-scanner | 2.3.6-r0 |
| wolfi | podman | 6.0.0-r0 |
| wolfi | scorecard | 5.4.0-r15 |
| wolfi | skaffold | 2.18.2-r1 |
| wolfi | trivy | 0.69.3-r6 |
| wolfi | trivy-operator | 0.30.1-r4 |
| wolfi | zot | 2.1.15-r4 |
Referenzen
- https://access.redhat.com/security/cve/CVE-2026-33747
- https://github.com/moby/buildkit
- https://github.com/moby/buildkit/releases/tag/v0.28.1
- https://github.com/moby/buildkit/security/advisories/GHSA-4c29-8rgm-jvjj
- https://nvd.nist.gov/vuln/detail/CVE-2026-33747
- https://ubuntu.com/security/notices/USN-8230-1
- https://www.cve.org/CVERecord?id=CVE-2026-33747