CVE-2026-33747

Description

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context. The issue has been fixed in v0.28.1. The vulnerability requires using an untrusted BuildKit frontend set with `#syntax` or `--build-arg BUILDKIT_SYNTAX`. Using these options with a well-known frontend image like `docker/dockerfile` is not affected.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
docker.io	26.04 LTS resolute	Vulnerable
	25.10 questing	Vulnerable
	24.04 LTS noble	Vulnerable
	22.04 LTS jammy	Vulnerable
	20.04 LTS focal	Vulnerable
	18.04 LTS bionic	Vulnerable
	16.04 LTS xenial	Vulnerable
docker.io-app	26.04 LTS resolute	Fixed 29.1.3-0ubuntu4.1
	25.10 questing	Vulnerable
	24.04 LTS noble	Fixed 29.1.3-0ubuntu3~24.04.2
	22.04 LTS jammy	Fixed 29.1.3-0ubuntu3~22.04.2
	20.04 LTS focal	Fixed 26.1.3-0ubuntu1~20.04.1+esm2

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro 30-day free trial

Notes

alexmurray

Traditionally the docker.io source package contained both the library and docker application. However, in releases that contain the docker.io-app source package, the docker.io source package contains only the library whilst the docker application itself is contained in the docker.io-app package.

sbeattie

docker packages contain an embedded copy of github:moby/buildkit

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
docker.io	Upstream: 099cf80 Upstream: 9ce6f62 Upstream: df43783 Upstream: 71577a5
docker.io-app	Upstream: 099cf80 Upstream: 9ce6f62 Upstream: df43783 Upstream: 71577a5

Severity score breakdown

Parameter	Value
Base score	8.4 · High
Attack vector	Local
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Related Ubuntu Security Notices (USN)

USN-8230-1
Docker vulnerabilities
6 May 2026