https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-08T22:01:06.425714+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-121520 CVE-2026-121520 — Malicious client could set xattr value outside of BuildKit state directory 2026-11-08T22:01:06.426894+00:00

Affected: Moby BuildKit

In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.