# CVE-2026-61711: Moby BuildKit custom frontend security bypass

Source: https://junglewise.ai/threats/cve-2026-61711-moby-buildkit-custom-frontend-security-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-61711 · Severity: medium · CVSS 4 · Published 2026-08-19

BuildKit is a containerization toolkit used to build Docker images and manage container security policies. A flaw allowed attackers using a malicious custom frontend to bypass critical Linux security features (Seccomp and AppArmor) that protect build containers, even when administrators had not authorized such access. This could allow an attacker to execute privileged operations inside the build environment without proper restriction.

Technologies: [github.com/moby/buildkit (Go)](https://junglewise.ai/threats/technologies/github-com-moby-buildkit). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-61711 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61711 being exploited in the wild.

**How severe is CVE-2026-61711?** Medium severity, with a CVSS score of 4, published 19 August 2026.

**Which products and versions are affected?** github.com/moby/buildkit (Go) <= 0.31.0, SEMVER:introduced=0,fixed=0.31.1.

**Is there a fix for CVE-2026-61711?** Yes. github.com/moby/buildkit (Go): upgrade to 0.31.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61711 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-61711?** Check whether you run github.com/moby/buildkit (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/moby/buildkit (Go): upgrade to 0.31.1 or later

  ```sh
  go get github.com/moby/buildkit@v0.31.1
  ```


## Technical details

This vulnerability is an improper input validation flaw (CWE-20) in BuildKit's frontend handling. A custom frontend could craft a malicious build request that would disable Seccomp and AppArmor sandboxing protections on the build container despite the security.insecure entitlement not being explicitly granted by the user. The vulnerability requires low privilege (authenticated user with BuildKit access) and network-accessible BuildKit instance. An attacker can craft such requests to remove kernel-level isolation protections, potentially allowing privilege escalation or container escape within the build environment. The fix was released in BuildKit v0.31.1 and later versions. The advisory recommends using only trusted BuildKit frontends as a workaround.

## Affected products

- Moby BuildKit <= 0.31.0

## Identifiers

- CVE-2026-61711
- GHSA-7236-3392-c5c6
- GO-2026-6255

## Timeline

- 2026-06-24: disclosed
- 2026-08-19: advisory
- 2026-06-24: patched: Fixed in v0.31.1+

## References

- [https://api.github.com/users/Alex0Young](https://api.github.com/users/Alex0Young)
- [https://github.com/Alex0Young](https://github.com/Alex0Young)
- [https://api.github.com/users/Alex0Young/gists%7B/gist_id%7D](https://api.github.com/users/Alex0Young/gists%7B/gist_id%7D)
- [https://api.github.com/users/Alex0Young/repos](https://api.github.com/users/Alex0Young/repos)
- [https://avatars.githubusercontent.com/u/34711157?v=4](https://avatars.githubusercontent.com/u/34711157?v=4)
- [https://api.github.com/users/Alex0Young/events%7B/privacy%7D](https://api.github.com/users/Alex0Young/events%7B/privacy%7D)

## Related threats

- [Moby BuildKit denial of service via unbounded group parsing](https://junglewise.ai/threats/cve-2026-61712-moby-buildkit-denial-of-service-via-unbounded-group-parsing)
- [GO-2026-4858 - BuildKit's Malicious frontend can cause file escape outside of storage root in github.com/moby/buildkit](https://junglewise.ai/threats/cve-2026-33747-buildkit-s-malicious-frontend-can-cause-file-escape-outside-of)
- [BuildKit Git URL subdir component can cause access to restricted files](https://junglewise.ai/threats/cve-2026-33748-buildkit-git-url-subdir-component-can-cause-access-to-restricted)
- [GO-2024-2493 - Host system file access in github.com/moby/buildkit](https://junglewise.ai/threats/cve-2024-23651-buildkit-vulnerable-to-possible-race-condition-with-accessing)
- [GO-2024-2492 - Panic in github.com/moby/buildkit](https://junglewise.ai/threats/cve-2024-23650-buildkit-vulnerable-to-possible-panic-when-incorrect-parameters)