VDB
CVE-2026-61711
CVE-2026-61711
PUBLISHED
CVSS 5.3 MEDIUM
Reported by GitHub_M · Published August 19, 2026
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/spec_linux.go treated the unsupported value as a non-sandbox mode without requiring the security.insecure entitlement. This disabled Seccomp and AppArmor protections for the build container even though Linux capabilities remained restricted. This issue is fixed in version 0.31.1.
Risk Scores
CVSS 4.0
5.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| moby | buildkit | < 0.31.1 |
| chainguard | skaffold-fips | 0 |
| wolfi | scorecard | 0 |
| chainguard | livekit-cli | 0 |
| github.com | moby/buildkit | 0 |
| chainguard | trivy-fips | 0 |
| chainguard | conftest-fips | 0 |
| chainguard | cloudbeat-9.4 | 0 |
| wolfi | guac | 0 |
| wolfi | skaffold | 0 |
| wolfi | conftest | 0 |
| amazon:2023 | runfinch-finch | 0 |
| chainguard | cloudbeat-fips-9.3 | 0 |
| chainguard | cloudbeat-9.5 | 0 |
| chainguard | guac | 0 |
| wolfi | trivy | 0 |
| wolfi | podman-6.0 | 0 |
| chainguard | skaffold | 0 |
| chainguard | kubescape-server-fips | 0 |
| chainguard | kaniko | 0 |
…and 20 more
Timeline
- Aug 19, 2026 CVE Published
- Aug 22, 2026 Coalition ESS Score
- Aug 24, 2026 EPSS Score
- Aug 26, 2026 EPSS Score
- Aug 30, 2026 EPSS Score
- Sep 4, 2026 EPSS Score
- Sep 4, 2026 Security Advisory
- Sep 9, 2026 EPSS Score
- Sep 12, 2026 EPSS Score
- Sep 16, 2026 EPSS Score
- Sep 18, 2026 EPSS Score
- Sep 24, 2026 EPSS Score
References
- https://github.com/moby/buildkit/security/advisories/GHSA-7236-3392-c5c6 x_refsource_CONFIRM
- https://github.com/moby/buildkit/commit/3ea6dd0ce7d269cdb8aa23348718e2c1bf64f109 x_refsource_MISC
- https://github.com/moby/buildkit/commit/64bbec89ca43dd95b2853edeca240c33c6729910 x_refsource_MISC
- https://github.com/moby/buildkit/releases/tag/v0.31.1 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-61711 advisory
- https://github.com/advisories/GHSA-7236-3392-c5c6 advisory