CVE-2026-33747

CVE-2026-33747 affects BuildKit versions prior to 0.28.1, enabling a malicious custom frontend to write files outside its intended state directory, effectively an arbitrary file write. Rated High with a CVSS score of 8.4, this vulnerability (CWE-22) has a high impact on confidentiality, integrity, and availability, requiring an untrusted BuildKit frontend to be used. There is currently no evidence of active exploitation, publicly available exploit code, or significant community discussion. The issue is resolved in BuildKit v0.28.1, and using well-known frontends like docker/dockerfile is not affected.