{"id":"CVE-2026-61711","aliases":["GHSA-7236-3392-c5c6","GO-2026-6255"],"title":"BuildKit: Custom frontend could bypass Seccomp/AppArmor","summary":"BuildKit: Custom frontend could bypass Seccomp/AppArmor","severity":"medium","vendor":"moby","product":"github.com/moby/buildkit","ecosystem":"go","affected":["github.com/moby/buildkit < 0.31.1"],"patched":["github.com/moby/buildkit 0.31.1"],"published":"2026-08-19","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:51:13.277422932Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-7236-3392-c5c6","references":[{"url":"https://github.com/moby/buildkit/security/advisories/GHSA-7236-3392-c5c6"},{"url":"https://github.com/moby/buildkit"},{"url":"https://github.com/moby/buildkit/commit/3ea6dd0ce7d269cdb8aa23348718e2c1bf64f109","label":"security-advisories@github.com"},{"url":"https://github.com/moby/buildkit/commit/64bbec89ca43dd95b2853edeca240c33c6729910","label":"security-advisories@github.com"},{"url":"https://github.com/moby/buildkit/releases/tag/v0.31.1","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-7236-3392-c5c6"}],"tags":["osv","go","nvd","ghsa"],"epss":0.00357,"epssPercentile":0.29486,"cwe":["CWE-20"],"ingestedAt":"2026-08-19T20:44:41.460Z","slug":"CVE-2026-61711","body":"## Overview\n\n### Impact\nA custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the `security.insecure` entitlement. Other security measures, like Linux capabilities were still applied to these containers.\n\n### Patches\nProblem has been fixed in versions v0.31.1+\n\n### Workarounds\nOnly use BuildKit frontends from trusted providers.\n\n## Affected packages\n\n- `github.com/moby/buildkit < 0.31.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/moby/buildkit 0.31.1`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}