BuildKit EUVD-2026-46312

Exploitation requires all of the following: (1) BuildKit is driven by a custom frontend or a client using the raw low-level API - not standard docker build/Dockerfile usage; (2) that client explicitly sets git.checkoutbundle=true during Git source checkout, a non-default option; (3) the build consumes an attacker-controlled or compromised ('malicious') Git source; and (4) a build is actually executed against it (active user interaction, UI:A). Limiting factors: the non-default checkoutbundle configuration and the raw-API/custom-frontend requirement sharply narrow the exposed population, the attacker needs low-privilege build access (PR:L), and the CVSS attack-requirement metric (AT:P) reflects that conditions beyond mere network reachability must hold - so default Docker installations are not exploitable.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H) scores 7.3 (High) and captures the real constraints well: network reachability of the Git source but with an attack requirement (AT:P), low privileges (PR:L), and active user interaction (UI:A) - i.e., a build must actually be run against the malicious source with a non-default option enabled. This is not a drive-by, unauthenticated network compromise: exploitation depends on a specific, non-default configuration (git.checkoutbundle=true) reachable only through custom frontends or raw low-level API clients, so standard docker build / Dockerfile users are not exposed. EPSS is not provided, KEV status is negative, and no POC is referenced, so real-world exploitation pressure appears low today despite the high technical impact. The provided 'Information Disclosure' tag conflicts with the vector's VC:H/VI:H/VA:H and the description's host command-invocation impact - treat this as a command/code-execution issue, not merely information disclosure, and verify the tag against the vendor advisory.

An attacker publishes or compromises a Git repository crafted to inject extra arguments into BuildKit's git checkout. A victim CI pipeline built on a custom BuildKit frontend that enables git.checkoutbundle=true builds an image from that repository, and during Git source checkout the crafted values are interpreted as command arguments, executing attacker-chosen commands on the build host. No public POC is referenced, and the attack requires the non-default option plus an actual build run (active user interaction).