CVE-2026-61711

A flaw was found in BuildKit. A custom frontend could craft a build request with an invalid security mode, leading to the disabling of Seccomp and AppArmor protections for the build container. This bypasses the intended sandbox mechanisms, potentially allowing for broader impact within the container, even though Linux capabilities remained restricted.

In Red Hat environments, this vulnerability is rated as a Moderate impact flaw because, while an unverified build frontend can bypass Seccomp and AppArmor profiles without requiring privileged entitlements, core container boundaries remain enforced through Linux namespaces and restricted capability sets. Exploitation requires processing builds defined by untrusted third-party frontends. In standard Red Hat platforms such as OpenShift and container tooling environments, builds typically execute within governed pipelines and predefined security contexts that constrain potential host impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.