Bug 2519912 (CVE-2026-61711)
| Summary: | CVE-2026-61711 github.com/moby/buildkit: BuildKit: Security bypass allows disabling container protections | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | abarbaro, akhatavk, akoudelk, alizardo, amctagga, anjoseph, anpicker, aoconnor, aos-team-art-private, aruklets, asatyam, asdas, bniver, bparees, cahl, cdrage, crizzo, derez, dfreiber, dhanak, diagrawa, dkeler, doconnor, dpaolell, drosa, drow, dschmidt, dsimansk, dymurray, eborisov, eglynn, flucifre, gmeno, gparvin, groman, gtanzill, hasun, ibolton, jburrell, jbuscemi, jcantril, jchui, jdelft, jfula, jhe, jjoyce, jlanda, jmatthew, jmontleo, jowilson, jprabhak, jpretori, jsamir, jschluet, jupierce, kaycoth, kbempah, kingland, kshier, ktsao, lball, lbragsta, lgamliel, lgarciaa, lhh, ljawale, mbenjamin, mbiarnes, mburns, mgarciac, mhackett, mnovotny, msilmser, nboldt, ngough, nyancey, oaljalju, ometelka, pakotvan, pgaikwad, ppalepu, ppostler, prdhamdh, psrna, ptisnovs, rekumar, rhaigner, rhel-process-autobot, rjohnson, rojacob, rushinde, sabiswas, sakbas, sausingh, sbratsla, sdawley, sghai, sidsharm, simaishi, slucidi, solenoci, sostapov, sseago, stcannon, sthirugn, suppawar, syedriko, teagle, thason, vereddy, veshanka, vkumar, vlaad, vvoronko, watson-tool-maintainers, wenshen, whayutin, wtam, xdharmai, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in BuildKit. A custom frontend could craft a build request with an invalid security mode, leading to the disabling of Seccomp and AppArmor protections for the build container. This bypasses the intended sandbox mechanisms, potentially allowing for broader impact within the container, even though Linux capabilities remained restricted.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-08-19 20:21:28 UTC
|