BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context. The issue has been fixed in v0.28.1. The vulnerability requires using an untrusted BuildKit frontend set with `#syntax` or `--build-arg BUILDKIT_SYNTAX`. Using these options with a well-known frontend image like `docker/dockerfile` is not affected.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8230-1 advisory.

    It was discovered that BuildKit, contained within Docker, incorrectly handled file path validation when     processing frontend API messages. An attacker could possibly use this issue to write files outside of the     intended state directory. (CVE-2026-33747)

    It was discovered that BuildKit, contained within Docker, incorrectly validated the subdir component of     Git URL fragments. An attacker could possibly use this issue to access files outside of the checked-out     repository root. (CVE-2026-33748)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-853a2fa7e5 advisory.

    - Update to release v29.4.0
    - Resolves: rhbz#2455894
    - Resolves  CVE-2026-34986: rhbz#2455665
    - Upstream new features and fixes

    ----

    - Update to release v29.3.1
    - Resolves: rhbz#2451425
    - Upstream notes that this release resolves: CVE-2026-34040,       CVE-2026-33997, CVE-2026-33748, CVE-2026-33747
    - Upstream fixes

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6ad76ebb29 advisory.

    update to 1.154.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-729f84f3b6 advisory.

    update to 1.154.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of the Docker Engine installed on the remote host is prior to 29.3.1. It is therefore affected by multiple vulnerabilities:

  - CVE-2026-34040: AuthZ plugin authorization bypass vulnerability. Authorization plugins could be bypassed     under specific conditions, potentially allowing unauthorized access.

  - CVE-2026-33997: Plugin privilege validation bypass vulnerability in 'docker plugin install' command.
    A flaw in privilege validation could be partially bypassed, potentially leading to unauthorized privilege     escalation.

  - CVE-2026-33748: BuildKit Git URL validation vulnerability. Insufficient validation of Git URL '#ref:subdir'     fragments could allow access to files outside the intended repository scope, leading to unauthorized     information disclosure.

  - CVE-2026-33747: BuildKit arbitrary file write vulnerability. An untrusted frontend could cause files to be     written outside the BuildKit state directory, potentially allowing local privilege escalation or unauthorized     file writes.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and     repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft     an API message that causes files to be written outside of the BuildKit state directory for the execution     context. The issue has been fixed in v0.28.1. The vulnerability requires using an untrusted BuildKit     frontend set with `#syntax` or `--build-arg BUILDKIT_SYNTAX`. Using these options with a well-known     frontend image like `docker/dockerfile` is not affected. (CVE-2026-33747)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
313210	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Docker vulnerabilities (USN-8230-1)	Nessus	Ubuntu Local Security Checks	high
310540	Fedora 44 : moby-engine (2026-853a2fa7e5)	Nessus	Fedora Local Security Checks	high
307048	Fedora 43 : doctl (2026-6ad76ebb29)	Nessus	Fedora Local Security Checks	critical
307047	Fedora 42 : doctl (2026-729f84f3b6)	Nessus	Fedora Local Security Checks	critical
304803	Docker Engine 29.3.1 Multiple Vulnerabilities	Nessus	Misc.	high
303992	Linux Distros Unpatched Vulnerability : CVE-2026-33747	Nessus	Misc.	critical

Detections

Analytics

CVE-2026-33747

critical

Tenable Plugins

high

high

critical

critical

high

critical