CVE-2026-61711

mediumpriority · track · 0EPSS 0.004 · 29 %ileDEFRRUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.36% (29th) EPSS

CVSS 6.3 · medium

Is it mine?

40 products

Check your exposure

Who says so?

4 sources

fstec_bdu · osv · cert_bund · certfr

EPSS · scored 2026-10-27

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/spec_linux.go treated the unsupported value as a non-sandbox mode without requiring the security.insecure entitlement. This disabled Seccomp and AppArmor protections for the build container even though Linux capabilities remained restricted. This issue is fixed in version 0.31.1.

cvss

Technical severity, 0–10. One row per scoring source.

6.3

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 1.3–6.3

v3.16.3mediumAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Lsecondary · FSTEC (BDU) RU

v4.05.3mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · security-advisories@github.com

v4.01.3lowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USCWE-20USCWE-20US

affected products (40)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Microsoft Azure Linux azl3all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
Open Source docker≤ cli <29.6.1cert_bundDE
Docker Inc. BuildKit≤ 0.31.1fstec_bduRU
Red Hat, Inc. Compliance Operatorall versionsfstec_bduRU
Red Hat, Inc. Confidential Compute Attestationall versionsfstec_bduRU
Red Hat, Inc. Kernel Module Management Operator for Red Hat Openshiftall versionsfstec_bduRU
Red Hat, Inc. Logical Volume Manager Storageall versionsfstec_bduRU
Red Hat, Inc. Migration Toolkit for Applications≤ 8fstec_bduRU
Red Hat, Inc. Migration Toolkit for Containersall versionsfstec_bduRU
Red Hat, Inc. Migration Toolkit for Virtualizationall versionsfstec_bduRU
Red Hat, Inc. OpenShift API for Data Protectionall versionsfstec_bduRU
Red Hat, Inc. OpenShift Serverlessall versionsfstec_bduRU
Red Hat, Inc. Openshift Service Mesh≤ 3fstec_bduRU
Red Hat, Inc. Pen Drive Powered by Red Hat Lightspeedall versionsfstec_bduRU
Red Hat, Inc. Power monitoring for Red Hat OpenShiftall versionsfstec_bduRU
Red Hat, Inc. Red Hat Advanced Cluster Management for Kubernetes 2all versionsfstec_bduRU
Red Hat, Inc. Red Hat Ansible Automation Platform≤ 2fstec_bduRU

showing 20 of 40

advisories (4)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-2111docker: Mehrere SchwachstellenDeutsch2026-06-28csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in docker ausnutzen, um einen Denial of Service Angriff durchzuführen oder Sicherheitsmaßnahmen zu umgehen.
GHSA-7236-3392-c5c6BuildKit: Custom frontend could bypass Seccomp/AppArmor2026-08-19ghsa · osvUS
### Impact A custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the `security.insecure` entitlement. Other security measures, like Linux capabilities were still applied to these containers. ### Patches Problem has been fixed in versions v0.31.1+ ### Workarounds Only use BuildKit frontends from trusted providers.
CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR
GO-2026-6255BuildKit: Custom frontend could bypass Seccomp/AppArmor in github.com/moby/buildkit2026-08-25vendor · osvUS
BuildKit: Custom frontend could bypass Seccomp/AppArmor in github.com/moby/buildkit

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

fstec_bdu osv cert_bund certfr NVD CVE.org MITRE

published 2026-08-19modified 2026-09-25

references (4) nvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan