REDHAT-BUG-2452076: Medium severity Moby BuildKit vulnerability

Published Mar 27, 2026
·
Updated

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context. The issue has been fixed in v0.28.1. The vulnerability requires using an untrusted BuildKit frontend set with #syntax or --build-arg BUILDKITSYNTAX. Using these options with a well-known frontend image like docker/dockerfile is not affected.

Affected Software

1 affected component
Moby BuildKit<0.28.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade moby/buildkit to a version that resolves this vulnerability.

    Fixed in 0.28.1
  2. Configuration

    If using BuildKit, avoid setting an untrusted custom frontend via `#syntax` or `--build-arg BUILDKIT_SYNTAX`; use a well-known frontend image such as `docker/dockerfile`, which is not affected.

    BuildKit frontend selection Untrusted custom BuildKit frontend usage via #syntax or BUILDKIT_SYNTAX = Use a trusted/well-known frontend image only (e.g., docker/dockerfile)

Event History

Mar 27, 2026
Data Sourced
via Red Hat·02:01 AM
DescriptionSeverityAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of REDHAT-BUG-2452076?

The severity of REDHAT-BUG-2452076 is medium with a score of 4.

2

How do I fix REDHAT-BUG-2452076?

To fix REDHAT-BUG-2452076, upgrade to Moby BuildKit version 0.28.1 or later.

3

What kind of vulnerability is REDHAT-BUG-2452076?

REDHAT-BUG-2452076 is a vulnerability that allows a custom BuildKit frontend to write files outside of the designated state directory.

4

What software is affected by REDHAT-BUG-2452076?

The affected software in REDHAT-BUG-2452076 is Moby BuildKit.

5

What does BuildKit do in relation to REDHAT-BUG-2452076?

BuildKit is a toolkit that efficiently converts source code into build artifacts, and in this vulnerability, it relates to improper API message handling by custom frontends.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203