CVE-2026-121520 — Vulnerability intelligence
—
Published:
- CVSS
- 4.5
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.