CVE-2026-121520
2026-11-03
23h17 +00:00
23h17 +00:00
指定 CVE 通知
随时了解指定 CVE 的变更。
CVE 描述
In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.
CVE 信息
相关弱点
| 弱点名称 | 来源 | |
|---|---|---|
| UNIX Symbolic Link (Symlink) Following The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files. |
