---
id: CVE-2024-23652
aliases:
  - GHSA-4v98-7qmw-rqr8
  - GO-2024-2494
title: BuildKit vulnerable to possible host system access from mount stub cleaner
summary: BuildKit vulnerable to possible host system access from mount stub cleaner
severity: critical
cvss: 10
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H'
vendor: moby
product: github.com/moby/buildkit
ecosystem: go
affected:
  - github.com/moby/buildkit < 0.12.5
patched:
  - github.com/moby/buildkit 0.12.5
published: '2024-01-31'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:04.779734057Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-4v98-7qmw-rqr8'
references:
  - url: 'https://github.com/moby/buildkit/security/advisories/GHSA-4v98-7qmw-rqr8'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-23652'
  - url: 'https://github.com/moby/buildkit/pull/4603'
  - url: 'https://github.com/moby/buildkit'
  - url: 'https://github.com/moby/buildkit/releases/tag/v0.12.5'
tags:
  - osv
  - go
  - exploit-available
epss: 0.02055
epssPercentile: 0.80437
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/abian2/CVE-2024-23652'
  checkedAt: '2026-09-23T07:13:28.644Z'
exploitAvailable: true
ingestedAt: '2026-09-12T03:13:01.753Z'
---

## Overview

### Impact
A malicious BuildKit frontend or Dockerfile using `RUN --mount` could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system.

### Patches
The issue has been fixed in v0.12.5

### Workarounds
Avoid using BuildKit frontend from an untrusted source or building an untrusted Dockerfile containing `RUN --mount` feature.

### References



## Affected packages

- `github.com/moby/buildkit < 0.12.5`

## Remediation

Upgrade to a patched release:

- `github.com/moby/buildkit 0.12.5`