BuildKit is a tool that compiles source code into build artifacts. Prior to version 0.31.1, a custom frontend could inject an invalid SecurityMode value into a build request. The executor logic treated this unsupported value as a non-sandbox mode without needing the security.insecure entitlement. This caused the Seccomp and AppArmor protections for the build container to be disabled while the container’s Linux capabilities remained restricted. Based on the disabling of those protections, it is inferred that the build container may run with less isolation than intended, potentially allowing it to perform privileged actions that would normally be blocked by the sandbox.

Vendors: Moby BuildKit. Product: BuildKit. Versions before v0.31.1 are impacted. Users who employ custom frontends that can submit build requests containing an invalid SecurityMode value are at risk.

CVSS score 5.3 indicates moderate risk. EPSS score < 1% suggests low likelihood of exploitation. The vulnerability is not listed in CISA KEV. Exploitation requires an attacker to be able to submit a crafted build request through a custom frontend. Once processed, the build container runs without Seccomp or AppArmor, effectively elevating its privileges within the container. This flaw is limited to environments that permit custom frontends and use BuildKit prior to v0.31.1.