UBUNTU-CVE-2026-121520: Medium severity ubuntu/docker.io vulnerability

Published Nov 3, 2026

Updated

In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.

Affected Software

12 affected components

ubuntu/docker.io*

ubuntu/docker.io-app*

ubuntu/docker.io*

ubuntu/docker.io-app*

ubuntu/docker.io*

ubuntu/docker.io-app*

ubuntu/docker.io*

ubuntu/docker.io-app*

ubuntu/docker.io*

ubuntu/docker.io-app*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade BuildKit to a version that resolves this vulnerability.
Fixed in v0.34.1

Event History

Nov 3, 2026

CVE Published

via OSV·11:17 PM

Data Sourced

via OSV·11:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are realistically exposed?

Build services running a BuildKit version earlier than v0.34.1 are affected if they accept build requests from untrusted users through the BuildKit control APIs. The issue is relevant to Ubuntu docker.io and docker.io-app installations using such a service configuration.

What level of access does an attacker need?

An attacker needs access to the BuildKit control APIs and must be able to submit a malicious build request. The provided data does not indicate that remote access without BuildKit API access is sufficient.

What is the potential impact on the host?

A malicious build request can set an extended attribute on a file outside the BuildKit state directory. Setting attributes in the trusted. or security. namespaces could allow a program on the host to gain elevated privileges.

What should be done if the service accepts untrusted build requests?

Update BuildKit to v0.34.1 or later. Until it is updated, do not allow untrusted users to submit build requests through the BuildKit control APIs.

UBUNTU-CVE-2026-121520: Medium severity ubuntu/docker.io vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are realistically exposed?

What level of access does an attacker need?

What is the potential impact on the host?

What should be done if the service accepts untrusted build requests?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically exposed?

What level of access does an attacker need?

What is the potential impact on the host?

What should be done if the service accepts untrusted build requests?