Is CVE-2026-61711 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61711 being exploited in the wild.

How severe is CVE-2026-61711?

Medium severity, with a CVSS score of 4, published 19 August 2026.

Which products and versions are affected?

github.com/moby/buildkit (Go) <= 0.31.0, SEMVER:introduced=0,fixed=0.31.1.

Is there a fix for CVE-2026-61711?

Yes. github.com/moby/buildkit (Go): upgrade to 0.31.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61711 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-61711?

Check whether you run github.com/moby/buildkit (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61711: Moby BuildKit custom frontend security bypass

Q: Is there a fix for CVE-2026-61711?

Yes. github.com/moby/buildkit (Go): upgrade to 0.31.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-61711 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-61711?

Check whether you run github.com/moby/buildkit (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61711 · Severity: medium · CVSS 4 · Published 2026-08-19

BuildKit is a containerization toolkit used to build Docker images and manage container security policies. A flaw allowed attackers using a malicious custom frontend to bypass critical Linux security features (Seccomp and AppArmor) that protect build containers, even when administrators had not authorized such access. This could allow an attacker to execute privileged operations inside the build environment without proper restriction.

Technologies: github.com/moby/buildkit (Go). Vendors: Go.

Quick answers

Is CVE-2026-61711 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61711 being exploited in the wild.
How severe is CVE-2026-61711?: Medium severity, with a CVSS score of 4, published 19 August 2026.
Which products and versions are affected?: github.com/moby/buildkit (Go) <= 0.31.0, SEMVER:introduced=0,fixed=0.31.1.
Is there a fix for CVE-2026-61711?: Yes. github.com/moby/buildkit (Go): upgrade to 0.31.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61711 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-61711?: Check whether you run github.com/moby/buildkit (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/moby/buildkit (Go): upgrade to 0.31.1 or later
```
go get github.com/moby/buildkit@v0.31.1
```

Technical details

This vulnerability is an improper input validation flaw (CWE-20) in BuildKit's frontend handling. A custom frontend could craft a malicious build request that would disable Seccomp and AppArmor sandboxing protections on the build container despite the security.insecure entitlement not being explicitly granted by the user. The vulnerability requires low privilege (authenticated user with BuildKit access) and network-accessible BuildKit instance. An attacker can craft such requests to remove kernel-level isolation protections, potentially allowing privilege escalation or container escape within the build environment. The fix was released in BuildKit v0.31.1 and later versions. The advisory recommends using only trusted BuildKit frontends as a workaround.

Affected products

Moby BuildKit <= 0.31.0

Identifiers

CVE-2026-61711
GHSA-7236-3392-c5c6
GO-2026-6255

Timeline

2026-06-24: disclosed
2026-08-19: advisory
2026-06-24: patched: Fixed in v0.31.1+

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.