CVE-2026-121520

In BuildKit versions prior to v0.34.1 , a malicious client with access to the BuildKit control APIs can submit a build request to set extended attributes on files outside the BuildKit state directory. Specifically, attributes in the trusted. or security. namespaces may be set, which could potenti...