---
id: CVE-2026-121520
title: Malicious client could set xattr value outside of BuildKit state directory
summary: >-
  In BuildKit versions prior to v0.34.1, a malicious client with access to the
  BuildKit control APIs can submit a build request that sets an extended
  attribute on a file outside the BuildKit state directory. Extended attributes
  in the trus…
severity: medium
cvss: 4.5
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H'
cvssSource: cna
cwe:
  - CWE-61
vendor: Moby
product: BuildKit
affected:
  - BuildKit < 0.34.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T19:30:46.298631Z'
published: '2026-11-03'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T19:31:00.151Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121520'
references:
  - url: 'https://github.com/moby/buildkit/security/advisories/GHSA-w26x-xg27-7qjc'
tags:
  - cve.org
epss: 0.00139
epssPercentile: 0.03266
ingestedAt: '2026-11-05T20:33:06.571Z'
---

## Overview

In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.

## Affected

- `BuildKit < 0.34.1`

## Remediation

Upgrade BuildKit to v0.34.1 or later.

### Workarounds

Restrict access to BuildKit control APIs to trusted clients and do not accept build requests from untrusted users.