PatchTheCVECVE-2026-33747: BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable
CVE-2026-33747 is a high-severity flaw (CVSS 8.4) affecting buildkit. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context. The issue has been fixed in v0.28.1. The vulnerability requires using an untrusted BuildKit frontend set with `#syntax` or `--buil
Why this priority
- High severity
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.4 (High) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.5% (top 57%) |
| CISA exploited list | No |
| Weakness | CWE-22 |
| Published | 2026-03-27 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-33747?
buildkit: upgrade to 0.28.1. Exact commands for each OS are on this page.
Is CVE-2026-33747 being exploited?
CVE-2026-33747 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-33747 affect?
CVE-2026-33747 affects buildkit. Severity is high (CVSS 8.4). BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft an API message that causes files t
How urgent is CVE-2026-33747?
Priority 40/100. High severity
Related CVEs
- CVE-2026-33748 HIGH 7.5 UPGRADE BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable
- CVE-2026-15788 HIGH 7.5 UPGRADE BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS di
- CVE-2026-15789 HIGH 7.5 UPGRADE A custom client can produce such an upload request to the BuildKit daemon that files can escape from the Build
- CVE-2026-15791 HIGH 7.5 UPGRADE A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory
- CVE-2026-15792 HIGH 7.5 UPGRADE A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with