CVE-2026-33747 - Vulnerability Analysis

Overview

BuildKit < 0.28.1 contains an unrestricted file write vulnerability caused by crafted API messages from custom frontends, letting attackers write files outside the BuildKit state directory, exploit requires untrusted frontend usage.

Severity & Score

Impact

Attackers can write files outside the intended directory, potentially leading to arbitrary file modification or system compromise.

Mitigation

Update to version 0.28.1 or later.

References

• https://github.com/moby/buildkit/releases/tag/v0.28.1
• https://github.com/moby/buildkit/security/advisories/GHSA-4c29-8rgm-jvjj

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner