Résumé
BuildKit: Custom frontend could bypass Seccomp/AppArmor
Détails de l’avis
Impact
A custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the security.insecure entitlement. Other security measures, like Linux capabilities were still applied to these containers.
Patches
Problem has been fixed in versions v0.31.1+
Workarounds
Only use BuildKit frontends from trusted providers.
Références
Vulnérabilités liées
Tout Supply chain →- HIGHCVE-2026-75975
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
- MEDIUMCVE-2026-18504
fastify vulnerable to schema validation bypass via root primitive coercion mismatch
- MEDIUMCVE-2026-73845
CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)
- HIGHCVE-2026-59724
Socket.IO: Engine.IO WebTransport SID DoS
- HIGHCVE-2026-55212
Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation
- CRITICALCVE-2026-55068
free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints