CVE-2026-121520 — Malicious client could set xattr value outside of BuildKit state directory

Exploitation evidence

Not listed in the latest downloaded CISA KEV catalog. This does not establish an absence of exploitation.

KEV checked 13 Nov 2026, 00:20 Jerusalem · Original catalog ↗

Reported products and versions

Moby / BuildKit

Default status: unaffected

affected: 0 to < 0.34.1 (semver)

Fixes and workarounds

Upgrade BuildKit to v0.34.1 or later.

Reported workarounds: Restrict access to BuildKit control APIs to trusted clients and do not accept build requests from untrusted users.

Sources and related reporting

CVE Program record ↗ · Download tracked evidence as JSON

https://github.com/moby/buildkit/security/advisories/GHSA-w26x-xg27-7qjc

Monitored source mentions

BleepingComputer — Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day ↗

Shared CVE identifiers link source mentions; they do not establish that the reports describe the same incident.

Observed change timeline

History begins when Egret first downloads each source. It is not the complete upstream CVE history.

12 Nov 2026, 18:20 Jerusalem · EPSS observation updated

Stored EPSS snapshot at this observation.

{
  "date": "2026-11-12",
  "epss": 0.00139,
  "percentile": 0.03302
}

11 Nov 2026, 12:20 Jerusalem · EPSS observation updated

Stored EPSS snapshot at this observation.

{
  "date": "2026-11-10",
  "epss": 0.00139,
  "percentile": 0.03278
}

11 Nov 2026, 12:20 Jerusalem · CVE Program record changed

Stored CNA snapshot at this observation.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-121520",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T19:30:46.298631Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T19:31:00.151Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BuildKit",
          "repo": "https://github.com/moby/buildkit",
          "vendor": "Moby",
          "versions": [
            {
              "lessThan": "0.34.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 4.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "Host security-label modification"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-61",
              "description": "CWE-61: UNIX Symbolic Link (Symlink) Following",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T22:11:57.202Z",
        "orgId": "686469e6-3ff6-451b-ab8b-cf5b9e89401e",
        "shortName": "Docker"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/moby/buildkit/security/advisories/GHSA-w26x-xg27-7qjc"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade BuildKit to v0.34.1 or later."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Malicious client could set xattr value outside of BuildKit state directory",
      "workarounds": [
        {
          "lang": "en",
          "value": "Restrict access to BuildKit control APIs to trusted clients and do not accept build requests from untrusted users."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "686469e6-3ff6-451b-ab8b-cf5b9e89401e",
    "assignerShortName": "Docker",
    "cveId": "CVE-2026-121520",
    "datePublished": "2026-11-03T22:11:57.202Z",
    "dateReserved": "2026-11-03T14:26:45.909Z",
    "dateUpdated": "2026-11-06T19:31:00.151Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}