{"id":"AZL-112756","summary":"CVE-2026-121520 affecting package moby-engine 25.0.18-1","details":"In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.","modified":"2026-11-07T14:18:05.076869672Z","published":"2026-11-03T23:17:34Z","upstream":["CVE-2026-121520"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121520"}],"affected":[{"package":{"name":"moby-engine","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/moby-engine"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"25.0.18-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-112756.json"}}],"schema_version":"1.9.2"}