CVE-2026-61711: Sandbox Escape via Protobuf SecurityMode Enum Validation Bypass in Moby BuildKit
Vulnerability ID: CVE-2026-61711
CVSS Score: 5.3
Published: 2026-08-19
A detailed technical analysis of CVE-2026-61711, an input validation flaw in Moby BuildKit prior to version 0.31.1. The flaw allows unauthorized or custom frontends to construct build execution environments where Seccomp and AppArmor configurations are completely disabled by supplying an invalid protobuf enum index, resulting in an elevated kernel-level attack surface inside the build sandbox.
TL;DR
Moby BuildKit before v0.31.1 fails to validate protobuf SecurityMode enums, allowing invalid values to disable Seccomp and AppArmor security profiles on execution containers.
Technical Details
- CWE ID: CWE-20
- Attack Vector: Network (AV:N)
- CVSS Score: 5.3
- EPSS Score: N/A
- Impact: Low (Confidentiality, Integrity, Availability)
- Exploit Status: None
- KEV Status: Not Listed
Affected Systems
- Moby BuildKit
-
BuildKit: < 0.31.1 (Fixed in:
0.31.1)
Code Analysis
Commit: 3ea6dd0
Validate security mode configuration when compiling OCI specifications
Commit: 64bbec8
Apply cherry-picked validation engine changes and integration tests
Mitigation Strategies
- Implement strict network segmentation to block access to BuildKit's TCP endpoint.
- Restrict build permissions to verified users on shared container hosts.
- Verify runtime logging for container execution flags in untrusted builds.
Remediation Steps:
- Identify running instances of Moby BuildKit and determine their current version.
- Retrieve and compile the updated v0.31.1 release package or install updated distributions.
- Reboot the BuildKit daemon to execute the patched binaries.
- Run test suites to confirm that builds utilizing invalid enums are actively rejected with the invalid security mode message.
References
Read the full report for CVE-2026-61711 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)