Medium severity · published Oct 5, 2026
CVE-2026-93320
BuildKit improperly handles special files in build snapshots
6.0
CVSS
0.1%
EPSS
No
On KEV
Description
BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BU
BuildKit · moby
through 0.33.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93320
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-93320
vendor-advisory
https://github.com/moby/buildkit/security/advisories/GHSA-9728-qjrv-2xh2
patch
https://github.com/moby/buildkit/releases/tag/v0.33.1
More from BuildKit
9.8
CVE-2026-33747
BuildKit vulnerable to malicious frontend causing file escape outside of storage root
7.5
CVE-2026-93318
Cache poisoning via unvalidated image layer DiffIDs
7.5
CVE-2026-15793
Git source checkout from a bundle file could lead to command injection
7.5
CVE-2026-15792
Possible panic when incorrect parameters sent from frontend
7.5
CVE-2026-15791
LLB file operation can be tricked to remove /tmp directory contents