CVE-2026-61711 moby CVE debrief

Who should care

Defenders responsible for BuildKit installations should assess exposure and apply the patch. This involves reviewing BuildKit versions and updating to 0.31.1 if necessary. Defenders should also review build container configurations to ensure proper security settings and monitor build container activity for potential security incidents. Security teams and vulnerability management teams should prioritize verifying exposure and applying the patch to BuildKit.

Why it matters

CVE-2026-61711 is a vulnerability in BuildKit that could lead to disabled Seccomp and AppArmor protections for the build container. Defenders should prioritize verifying exposure and applying the patch to BuildKit installations.

• Verification of BuildKit version and potential exposure
• Update to version 0.31.1 to apply patch
• Review of build container configurations and security settings

Technical summary

CVE-2026-61711 is a vulnerability in BuildKit that allows a custom frontend to place an invalid SecurityMode value in a crafted build request. This could lead to disabled Seccomp and AppArmor protections for the build container. The issue is fixed in version 0.31.1. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. Defenders should prioritize verifying exposure and applying the patch to BuildKit installations. This involves reviewing BuildKit versions and updating to 0.31.1 if necessary. The vulnerability affects BuildKit installations prior to version 0.31.1.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch to BuildKit installations. This involves reviewing BuildKit versions and updating to 0.31.1 if necessary.

Recommended defensive actions

• Verify BuildKit version and update to 0.31.1 if necessary
• Review build container configurations to ensure proper security settings
• Monitor build container activity for potential security incidents
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• technicalSummary
• whoShouldCare

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the scope of affected versions and potential impact require further verification from official sources. The vulnerability was introduced due to improper handling of SecurityMode values in build requests. Official sources indicate that an update to version 0.31.1 is necessary to address this issue. Additional verification is required to determine the full extent of potential exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.