CVE-2026-61711: Moby BuildKit custom frontend security bypass

Executive brief

BuildKit is a containerization toolkit used to build Docker images and manage container security policies. A flaw allowed attackers using a malicious custom frontend to bypass critical Linux security features (Seccomp and AppArmor) that protect build containers, even when administrators had not authorized such access. This could allow an attacker to execute privileged operations inside the build environment without proper restriction.

Technical details

This vulnerability is an improper input validation flaw (CWE-20) in BuildKit's frontend handling. A custom frontend could craft a malicious build request that would disable Seccomp and AppArmor sandboxing protections on the build container despite the security.insecure entitlement not being explicitly granted by the user. The vulnerability requires low privilege (authenticated user with BuildKit access) and network-accessible BuildKit instance. An attacker can craft such requests to remove kernel-level isolation protections, potentially allowing privilege escalation or container escape within the build environment. The fix was released in BuildKit v0.31.1 and later versions. The advisory recommends using only trusted BuildKit frontends as a workaround.

Affected products

• Moby BuildKit <= 0.31.0

Timeline

• 2026-06-24: disclosed
• 2026-08-19: advisory
• 2026-06-24: patched: Fixed in v0.31.1+

References

• https://api.github.com/users/Alex0Young
• https://github.com/Alex0Young
• https://api.github.com/users/Alex0Young/gists%7B/gist_id%7D
• https://api.github.com/users/Alex0Young/repos
• https://avatars.githubusercontent.com/u/34711157?v=4
• https://api.github.com/users/Alex0Young/events%7B/privacy%7D