Medium severity · published Oct 5, 2026
CVE-2026-93315
BuildKit proxy CA cleanup can be disrupted by build steps
5.8
CVSS
0.1%
EPSS
No
On KEV
Description
When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BU
BuildKit · moby
0.31.0 before 0.33.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93315
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-93315
vendor-advisory
https://github.com/moby/buildkit/security/advisories/GHSA-2f5p-x9ph-g97x
patch
https://github.com/moby/buildkit/releases/tag/v0.33.1
More from BuildKit
9.8
CVE-2026-33747
BuildKit vulnerable to malicious frontend causing file escape outside of storage root
7.5
CVE-2026-93318
Cache poisoning via unvalidated image layer DiffIDs
7.5
CVE-2026-15793
Git source checkout from a bundle file could lead to command injection
7.5
CVE-2026-15792
Possible panic when incorrect parameters sent from frontend
7.5
CVE-2026-15791
LLB file operation can be tricked to remove /tmp directory contents