Detections
Analytics

SCA: security update for github.com/moby/buildkit (GHSA-4c29-8rgm-jvjj)

critical Tenable Self-Hosted Container Security Plugin ID 439263

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and
 repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft
 an API message that causes files to be written outside of the BuildKit state directory for the execution
 context. The issue has been fixed in v0.28.1. The vulnerability requires using an untrusted BuildKit
 frontend set with `#syntax` or `--build-arg BUILDKIT_SYNTAX`. Using these options with a well-known
 frontend image like `docker/dockerfile` is not affected. (CVE-2026-33747)

Solution

Update the github.com/moby/buildkit library and its related packages to version 0.28.1 or later.

See Also

https://github.com/advisories/GHSA-4c29-8rgm-jvjj

Plugin Details

Severity: Critical

ID: 439263

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 3/26/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.92

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-33747

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/26/2026

Vulnerability Publication Date: 3/26/2026

Reference Information

CVE: CVE-2026-33747

cwe: CWE-22