CVE-2026-61711

Received Received - Intake

BuildKit SecurityMode Bypass in Container Builds

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/spec_linux.go treated the unsupported value as a non-sandbox mode without requiring the security.insecure entitlement. This disabled Seccomp and AppArmor protections for the build container even though Linux capabilities remained restricted. This issue is fixed in version 0.31.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-61711

EUVD

EUVD-2026-62838

Affected Vendors & Products

Vendor	Product	Version / Range
buildkit	buildkit	to 0.31.1 (inc)
moby	buildkit	to 0.31.1 (exc)
moby	buildkit	0.31.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

BuildKit is a toolkit for converting source code to build artifacts. Prior to version 0.31.1, a custom frontend could send a crafted build request with an invalid SecurityMode value. This caused BuildKit to disable Seccomp and AppArmor protections for the build container without requiring the security.insecure entitlement, even though Linux capabilities remained restricted.

Detection Guidance

To detect this vulnerability, check the BuildKit version in use. Run: docker buildx version or buildctl --version. If the version is below 0.31.1, the system is vulnerable. Additionally, inspect build requests for invalid SecurityMode values in executor specifications.

Impact Analysis

This vulnerability allows a malicious or compromised frontend to bypass container security protections like Seccomp and AppArmor. This could enable unauthorized system calls or security policy circumvention during build processes, potentially leading to container escapes or other security breaches.

Mitigation Strategies

Upgrade BuildKit to version 0.31.1 or later. Use trusted BuildKit frontends only. Verify that security modes are properly validated in build requests to prevent bypassing sandbox protections like Seccomp and AppArmor.

Hi! I’m here to help you understand CVE-2026-61711. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70