github.com/moby/buildkit

concurrent, cache-efficient, and Dockerfile-agnostic builder toolkit

View on Go

View on Github

Activity

Latest release: 3w ago
Total releases: 67
Cadence: ~8 days
Last 12 months: 31

Reach

Stars: 10.3k

Details

First release: Oct 31, 2018

Releases

Version	Released
`v0.34.1` patch	Oct 07, 2026
`v0.34.0` minor	Oct 07, 2026
`v0.34.0-rc2` pre	Oct 06, 2026
`v0.34.0-rc1` pre	Sep 30, 2026
`v0.33.1` patch	Sep 30, 2026
`v0.33.0-rc2` pre	Sep 01, 2026
`v0.33.0` minor	Sep 01, 2026
`v0.33.0-rc1` pre	Aug 26, 2026
`v0.32.2` patch	Aug 04, 2026
`v0.32.1` patch	Aug 03, 2026
`v0.32.0` minor	Jul 27, 2026
`v0.32.0-rc2` pre	Jul 27, 2026
`v0.32.0-rc1` pre	Jul 22, 2026
`v0.31.2` patch	Jul 16, 2026
`v0.31.1` patch	Jun 24, 2026
`v0.31.0` minor 2 CVEs	Jun 16, 2026
`v0.31.0-rc2` pre 2 CVEs	Jun 12, 2026
`v0.31.0-rc1` pre 2 CVEs	Jun 10, 2026
`v0.30.0` minor 2 CVEs	May 13, 2026
`v0.30.0-rc2` pre 2 CVEs	May 11, 2026
`v0.30.0-rc1` pre 2 CVEs	May 06, 2026
`v0.29.0` minor 2 CVEs	Mar 31, 2026
`v0.29.0-rc1` pre 2 CVEs	Mar 25, 2026
`v0.28.1` patch 2 CVEs	Mar 25, 2026
`v0.28.0` minor 4 CVEs	Mar 03, 2026
`v0.28.0-rc2` pre 4 CVEs	Feb 26, 2026
`v0.28.0-rc1` pre 4 CVEs	Feb 24, 2026
`v0.27.1` minor 4 CVEs	Jan 28, 2026
`v0.27.0-rc1` pre 4 CVEs	Jan 14, 2026
`v0.26.2` minor 4 CVEs	Nov 20, 2025
`v0.25.2` minor 4 CVEs	Nov 05, 2025
`v0.24.0-rc2` pre 4 CVEs	Aug 29, 2025
`v0.23.0-rc2` pre 4 CVEs	Jun 16, 2025
`v0.23.0-rc1` pre 4 CVEs	Jun 11, 2025
`v0.21.0-rc2` pre 4 CVEs	Apr 11, 2025
`v0.20.0-rc3` pre 4 CVEs	Feb 18, 2025
`v0.19.0-rc1` pre 4 CVEs	Jan 14, 2025
`v0.17.2` patch 4 CVEs	Nov 22, 2024
`v0.18.0-rc1` pre 4 CVEs	Nov 21, 2024
`v0.17.0` minor 4 CVEs	Oct 29, 2024
`v0.16.0` minor 4 CVEs	Sep 10, 2024
`v0.16.0-rc2` pre 4 CVEs	Sep 09, 2024
`v0.15.1` minor 4 CVEs	Jul 25, 2024
`v0.14.0-rc2` pre 4 CVEs	Jun 06, 2024
`v0.13.0` minor 4 CVEs	Mar 05, 2024
`v0.13.0-rc2` pre 4 CVEs	Feb 24, 2024
`v0.13.0-rc1` pre 4 CVEs	Feb 15, 2024
`v0.13.0-beta3` pre 4 CVEs	Jan 31, 2024
`v0.13.0-beta2` pre 4 CVEs	Jan 30, 2024
`v0.12.4` patch 8 CVEs	Nov 29, 2023

1–50 of 67

Repository

moby/buildkit

Forks: 1.5k
Open issues: 746
Language: Go
: 8.6/ 10

buildkit
dockerfile
docker
oci-image
oci
containers

Dependencies (113)

Depends on

v0.34.1

Used by

906

Supply-chain exposure

906 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Vulnerable dependencies

1 of 113

golang.org/x/crypto 1 CVE

These dependencies are still vulnerable in their latest release. Whether the exact version this package pins is affected isn't checked yet.

Known CVEs (9)

CVE-2026-61712 GO-2026-6256 GHSA-72x6-4j93-7w86 Aug 25, 2026

BuildKit has a possible runtime DoS via unbounded group parsing in github.com/moby/buildkit

BuildKit has a possible runtime DoS via unbounded group parsing in github.com/moby/buildkit

Fixed in

0.31.1

References

https://github.com/moby/buildkit/security/advisories/GHSA-72x6-4j93-7w86
https://github.com/moby/buildkit/commit/408266e4ba254cecabedaacdad6905de4d2a75a1
https://github.com/moby/buildkit/commit/69a3924648e485acb3faad3081e03a8554431255
https://github.com/moby/buildkit/releases/tag/v0.31.1

Updated Sep 01, 2026 · Source: OSV.dev
CVE-2026-61711 GO-2026-6255 GHSA-7236-3392-c5c6 Aug 25, 2026

BuildKit: Custom frontend could bypass Seccomp/AppArmor in github.com/moby/buildkit

BuildKit: Custom frontend could bypass Seccomp/AppArmor in github.com/moby/buildkit

Fixed in

0.31.1

References

https://github.com/moby/buildkit/security/advisories/GHSA-7236-3392-c5c6

Updated Sep 01, 2026 · Source: OSV.dev
CVE-2026-33748 GO-2026-4859 GHSA-4vrq-3vrq-g6gg Mar 27, 2026

BuildKit Git URL subdir component can cause access to restricted files in github.com/moby/buildkit

BuildKit Git URL subdir component can cause access to restricted files in github.com/moby/buildkit

Fixed in

0.28.1

References

https://github.com/moby/buildkit/security/advisories/GHSA-4vrq-3vrq-g6gg
https://docs.docker.com/build/concepts/context/#url-fragments
https://github.com/moby/buildkit/releases/tag/v0.28.1

Updated Mar 28, 2026 · Source: OSV.dev
CVE-2026-33747 GO-2026-4858 GHSA-4c29-8rgm-jvjj Mar 27, 2026

BuildKit's Malicious frontend can cause file escape outside of storage root in github.com/moby/buildkit

BuildKit's Malicious frontend can cause file escape outside of storage root in github.com/moby/buildkit

Fixed in

0.28.1

References

https://github.com/moby/buildkit/security/advisories/GHSA-4c29-8rgm-jvjj
https://github.com/moby/buildkit/releases/tag/v0.28.1

Updated Mar 28, 2026 · Source: OSV.dev
CVE-2024-23651 GO-2024-2493 GHSA-m3r6-h7wv-7xxv Feb 13, 2024

Host system file access in github.com/moby/buildkit

Two malicious build steps running in parallel sharing the same cache mounts with subpaths could cause a race condition that can lead to files from the host system being accessible to the build container.

Fixed in

0.12.5

References

https://github.com/moby/buildkit/pull/4604

Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-23650 GO-2024-2492 GHSA-9p26-698r-w4hx Feb 12, 2024

Panic in github.com/moby/buildkit

A malicious BuildKit client or frontend could craft a request that could lead to a BuildKit daemon crashing with a panic.

Fixed in

0.12.5

References

https://github.com/moby/buildkit/pull/4601
https://github.com/moby/buildkit/commit/e1924dc32da35bfb0bfdbb9d0fc7bca25e552330
https://github.com/moby/buildkit/commit/7718bd5c3dc8fc5cd246a30cc41766e7a53c043c
https://github.com/moby/buildkit/commit/96663dd35bf3787d7efb1ee7fd9ac7fe533582ae
https://github.com/moby/buildkit/commit/481d9c45f473c58537f39694a38d7995cc656987
https://github.com/moby/buildkit/commit/83edaef59d545b93e2750f1f85675a3764593fee

Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-23652 GO-2024-2494 GHSA-4v98-7qmw-rqr8 Feb 12, 2024

Host system modification in github.com/moby/buildkit

A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system.

Fixed in

0.12.5

References

https://github.com/moby/buildkit/security/advisories/GHSA-4v98-7qmw-rqr8
https://github.com/moby/buildkit/pull/4603
https://github.com/moby/buildkit/releases/tag/v0.12.5

Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-23653 GO-2024-2497 GHSA-wr6v-9f75-vh2g Feb 07, 2024

Privilege escalation in github.com/moby/buildkit

BuildKit provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special security.insecure entitlement is enabled both by buildkitd configuration and allowed by the user initializing the build request.

Fixed in

0.12.5

References

https://github.com/moby/buildkit/pull/4602
https://github.com/moby/buildkit/commit/92cc595cfb12891d4b3ae476e067c74250e4b71e
https://github.com/moby/buildkit/commit/5026d95aa3336e97cfe46e3764f52d08bac7a10e
https://github.com/moby/buildkit/releases/tag/v0.12.5

Updated Feb 04, 2026 · Source: OSV.dev
CVE-2023-26054 GHSA-gc89-7gcr-jxqc Mar 07, 2023

Buildkit credentials inlined to Git URLs could end up in provenance attestation

6.5 / 10
Medium
Network Low None Required Unchanged High None None

When the user sends a build request that contains a Git URL that contains credentials and the build creates a provenance attestation describing that build, these credentials could be visible from the provenance attestation.

Git URL can be passed in two ways:

Invoking build directly from a URL with credentials.

buildctl build --frontend dockerfile.v0 --context https://<credentials>@url/repo.git

Equivalent in docker buildx would be

docker buildx build https://<credentials>@url/repo.git

If the client sends additional VCS info hint parameters on builds from a local source. Usually, that would mean reading the origin URL from .git/config file.

Thanks to Oscar Alberto Tovar for discovering the issue.

Impact

When a build is performed under specific conditions where credentials were passed to BuildKit they may be visible to everyone who has access to provenance attestation.

Provenance attestations and VCS info hints were added in version v0.11.0. Previous versions are not vulnerable.

In v0.10, when building directly from Git URL, the same URL could be visible in BuildInfo structure that is a predecessor of Provenance attestations. Previous versions are not vulnerable.

Note: Docker Build-push Github action builds from Git URLs by default but is not affected by this issue even when working with private repositories because the credentials are passed with build secrets and not with URLs.

Patches

Bug is fixed in v0.11.4 .

Workarounds

It is recommended to pass credentials with build secrets when building directly from Git URL as a more secure alternative than modifying the URL.

In Docker Buildx, VCS info hint can be disabled by setting BUILDX_GIT_INFO=0. buildctl does not set VCS hints based on .git directory, and values would need to be passed manually with --opt.

References

Inline credentials in URLs deprecated in RFC3986 https://www.rfc-editor.org/rfc/rfc3986#section-3.2.1

Fixed in

0.11.4

References

https://github.com/moby/buildkit/security/advisories/GHSA-gc89-7gcr-jxqc
https://nvd.nist.gov/vuln/detail/CVE-2023-26054
https://github.com/moby/buildkit/commit/75123c696506bdbca1ed69906479e200f1b62604
https://github.com/moby/buildkit
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE

Updated Nov 08, 2023 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

minor 21
patch 13
pre 32

67 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More