Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-93315— BuildKit proxy CA cleanup can be disrupted by build steps

Quick assessment

Affected

moby BuildKit

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

当启用了带有 CA 注入的代理网络时，构建过程可以在清理阶段之前修改其 CA 证书包。这可能导致清理过程阻塞、在构建根文件系统之外执行操作，或在未导致构建失败的情况下出现错误。

CVSS 5.8 · Medium Updated Oct 06, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

BuildKit proxy CA cleanup can be disrupted by build steps

Source: CVE Program / CVE List V5

Vulnerability Description

When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

检查时间与使用时间(TOCTOU)的竞争条件

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
moby	BuildKit	0.31.0 ~ 0.33.1	-

II. Public POCs for CVE-2026-93315

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-93315

请登录查看更多情报信息。

Vendor Pages for CVE-2026-93315 (1)

🔗 Release v0.33.1 · moby/buildkit · GitHub Read full article patch

Other References for CVE-2026-93315 (1)

https://github.com/moby/buildkit/security/advisories/GHSA-2f5p-x9ph-g97x vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-93315

Same Patch Batch · moby · 2026-10-05 · 10 CVEs total

CVE-2026-93318	7.5 HIGH	Cache poisoning via unvalidated image layer DiffIDs
CVE-2026-93316	7.1 HIGH	Starting daemon with --cdi-disabled flag can lead to panic on specific builds
CVE-2026-93322	6.9 MEDIUM	Malformed MergeOp can crash the BuildKit daemon
CVE-2026-93321	6.9 MEDIUM	Malformed LLB file operation can crash buildkitd
CVE-2026-93323	6.8 MEDIUM	Oversized Dockerfile or .dockerignore can exhaust buildkitd memory
CVE-2026-93320	6.0 MEDIUM	BuildKit improperly handles special files in build snapshots
CVE-2026-93326	6.0 MEDIUM	Crafted Git build source can bypass certain policy validation
CVE-2026-93317	5.9 MEDIUM	Container blob cache can accept unverified content
CVE-2026-93319	5.7 MEDIUM	A malicious frontend can cause a daemon panic

IV. Related Vulnerabilities

Same product: BuildKit

Same vendor: moby

Same weakness: CWE-367

V. Comments for CVE-2026-93315

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-93315— BuildKit proxy CA cleanup can be disrupted by build steps

Quick assessment

I. Basic Information for CVE-2026-93315

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-93315

III. Intelligence Information for CVE-2026-93315

Vendor Pages for CVE-2026-93315 (1)

Other References for CVE-2026-93315 (1)

Same Patch Batch · moby · 2026-10-05 · 10 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-93315

Leave a comment