github.com/moby/buildkit vulnerabilities
CVEs whose affected-version data names the github.com/moby/buildkit package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
10 CVEsRSS
CVE-2026-93321Medium· 6.9A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.
A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.
CVE-2026-93315Medium· 5.8When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup
When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build.
CVE-2026-93326Medium· 6.0A build step for a Git source, crafted in a specific way, can bypass some policy validation rules
A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look like it is coming from a different remote URL than it really is when Git clone i…
CVE-2026-93323Medium· 6.8The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit
The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing an oversized file could make buildkitd allocate memory proportional to that file, poten…
CVE-2026-93322Medium· 6.9A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.
A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.
CVE-2026-93320Medium· 6.0⚖ disputedBuildKit may be tricked into performing file actions with special file inodes where regular files are expected
BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access.
CVE-2026-93319Medium· 5.7A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic.
A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic.
CVE-2026-93318High· 7.5A malicious image can advertise DiffIDs from another image while containing different layer contents
A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matc…
CVE-2026-93317Medium· 5.9An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest
An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, …
CVE-2024-23652Critical· 10.0PoCBuildKit vulnerable to possible host system access from mount stub cleaner
BuildKit vulnerable to possible host system access from mount stub cleaner