Is CVE-2026-33747 actively exploited?

No active exploitation of CVE-2026-33747 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-33747 be exploited remotely?

Yes. CVE-2026-33747 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-33747?

CVE-2026-33747 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2026-33747

CRITICAL

CVE-2026-33747

CWE-22Published: March 27, 2026· Updated: Apr 1, 2026

9.8

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:0.4th

Official Description

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context. The issue has been fixed in v0.28.1. The vulnerability requires using an untrusted BuildKit frontend set with `#syntax` or `--build-arg BUILDKIT_SYNTAX`. Using these options with a well-known frontend image like `docker/dockerfile` is not affected.

NVD Source

Technical Analysis

CVE-2026-33747 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.