Priority LOW 30
BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources.
Vulnerabilities
12 records
Priority LOW 28
A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic.
Priority LOW 16
A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory.
TI-2026-13283 CVE-2026-15789
Malicious client can bypass destination directory validation on local sources upload
Priority LOW 30
A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory.
TI-2026-13282 CVE-2026-15788
WCOW cache mount source selector resolves NTFS junctions outside of cache root
Priority LOW 25
BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root.
TI-2026-26127 CVE-2026-33748 · GHSA-4vrq-3vrq-g6gg
BuildKit Git URL subdir component can cause access to restricted files
Priority LOW 36
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.
TI-2026-26126 CVE-2026-33747 · GHSA-4c29-8rgm-jvjj
BuildKit vulnerable to malicious frontend causing file escape outside of storage root
Priority MEDIUM 43
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.
TI-2024-15672 CVE-2024-23653 · GHSA-wr6v-9f75-vh2g
BuildKit interactive containers API does not validate entitlements check
Priority MEDIUM 55
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.
TI-2024-15671 CVE-2024-23652 · GHSA-4v98-7qmw-rqr8
BuildKit possible host system access from mount stub cleaner
Priority MEDIUM 54
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.
TI-2024-15670 CVE-2024-23651 · GHSA-m3r6-h7wv-7xxv
BuildKit possible race condition with accessing subpaths from cache mounts
Priority MEDIUM 41
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.
TI-2024-15669 CVE-2024-23650 · GHSA-9p26-698r-w4hx
BuildKit possible panic when incorrect parameters sent from frontend
Priority LOW 32
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.
TI-2023-11287 CVE-2023-26054 · GHSA-gc89-7gcr-jxqc
Credentials inlined to Git URLs could end up in provenance attestation in BuildKit
Priority LOW 31
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.