CVE-2026-121520

Name of the Vulnerable Software and Affected Versions BuildKit versions prior to 0.34.1

Description A malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file located outside the BuildKit state directory. This includes the ability to set extended attributes within the trusted. or security. namespaces, which could allow a program on the host to obtain elevated privileges. This issue primarily impacts build services that process requests from untrusted users.

Recommendations Update BuildKit to version 0.34.1.