Is CVE-2026-33748 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33748 being exploited in the wild.

How severe is CVE-2026-33748?

High severity, with a CVSS score of 7.5, published 27 March 2026.

Which products and versions are affected?

github.com/moby/buildkit (Go) < 0.28.1, SEMVER:introduced=0,fixed=0.28.1.

Is there a fix for CVE-2026-33748?

Yes. github.com/moby/buildkit (Go): upgrade to 0.28.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Am I affected by CVE-2026-33748?

Check whether you run github.com/moby/buildkit (Go) or Mobyproject Buildkit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33748: BuildKit Git URL subdir component can cause access to restricted files

Q: Is there a fix for CVE-2026-33748?

Yes. github.com/moby/buildkit (Go): upgrade to 0.28.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: Am I affected by CVE-2026-33748?

Check whether you run github.com/moby/buildkit (Go) or Mobyproject Buildkit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33748 · Severity: high · CVSS 7.5 · Published 2026-03-27

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem. The issue has been fixed in version v0.28.1 The issue affects only builds that use Git URLs with a subpath component. As a workaround, avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.

Technologies: github.com/moby/buildkit (Go). Vendors: Go.

Quick answers

Is CVE-2026-33748 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33748 being exploited in the wild.
How severe is CVE-2026-33748?: High severity, with a CVSS score of 7.5, published 27 March 2026.
Which products and versions are affected?: github.com/moby/buildkit (Go) < 0.28.1, SEMVER:introduced=0,fixed=0.28.1.
Is there a fix for CVE-2026-33748?: Yes. github.com/moby/buildkit (Go): upgrade to 0.28.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2026-33748?: Check whether you run github.com/moby/buildkit (Go) or Mobyproject Buildkit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/moby/buildkit (Go): upgrade to 0.28.1 or later
```
go get github.com/moby/buildkit@v0.28.1
```

Affected products

github.com/moby/buildkit (Go) < 0.28.1, SEMVER:introduced=0,fixed=0.28.1
Mobyproject Buildkit

Identifiers

CVE-2026-33748
GHSA-4vrq-3vrq-g6gg
GO-2026-4859

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.