AZL-112726

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-112726.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-112726

Upstream

CVE-2026-121520

Published

2026-11-03T23:17:34Z

Modified

2026-11-07T14:19:16Z

Summary

CVE-2026-121520 affecting package docker-buildx 0.14.0-19

Details

In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-121520

Affected packages

Azure Linux:3 / docker-buildx

Package

Name: docker-buildx
Purl: pkg:rpm/azure-linux/docker-buildx

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

0.14.0-19

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-112726.json"