← Vulnerability feed

Vulnerability record · CVE-2024-23653 · published 31 January 2024

CVE-2024-23653: Mobyproject buildkit incorrect authorization vulnerability

Mobyproject · Buildkit

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special `security.insecure` entitlement is enabled both by buildkitd configuration and allowed by the user initializing the build request. The issue has been fixed in v0.12.5 . Avoid using BuildKit frontends from untrusted sources.

9.8 CVSS 3.1 Critical EPSS 3.0% · top 13.2% CWE-863 · Incorrect authorization
9.8CVSS 3.1 base score
3.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special `security.insecure` entitlement is enabled both by buildkitd configuration and allowed by the user initializing the build request. The issue has been fixed in v0.12.5 . Avoid using BuildKit frontends from untrusted sources.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/moby/buildkit/pull/4602 PatchVendor Advisory
https://github.com/moby/buildkit/releases/tag/v0.12.5 PatchRelease Notes
https://github.com/moby/buildkit/security/advisories/GHSA-wr6v-9f75-vh2g Vendor Advisory
https://github.com/moby/buildkit/pull/4602 PatchVendor Advisory
https://github.com/moby/buildkit/releases/tag/v0.12.5 PatchRelease Notes
https://github.com/moby/buildkit/security/advisories/GHSA-wr6v-9f75-vh2g Vendor Advisory

Track CVE-2024-23653 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-33747Mobyproject buildkit path traversal vulnerabilityBuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when …EPSS 0.58%9.1CVE-2024-23652Mobyproject buildkit path traversal vulnerabilityBuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend …EPSS 2.1%8.2CVE-2026-33748Mobyproject buildkit path traversal vulnerabilityBuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insuf…EPSS 0.53%7.4CVE-2024-23651Mobyproject buildkit race condition vulnerabilityBuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Two malicious build steps runn…EPSS 0.79%7.3CVE-2026-15793Mobyproject buildkit argument injection vulnerabilityBuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is …EPSS 0.35%6.9CVE-2026-15789Mobyproject buildkit path traversal vulnerabilityA custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The cli…EPSS 0.31%6.5CVE-2023-26054Mobyproject buildkit information exposure vulnerabilityBuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In affected versions when the …EPSS 1.0%6.0CVE-2026-15792Mobyproject buildkit improper input validation vulnerabilityA malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic.EPSS 0.42%

Source: NIST National Vulnerability Database (record CVE-2024-23653), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.