Medium severity · published Oct 5, 2026
CVE-2026-93315
BuildKit proxy CA cleanup can be disrupted by build steps
5.8
CVSS
0.1%
EPSS
No
On KEV
Description
When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BU
BuildKit · moby
0.31.0 before 0.33.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93315
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-93315
vendor-advisory
https://github.com/moby/buildkit/security/advisories/GHSA-2f5p-x9ph-g97x
patch
https://github.com/moby/buildkit/releases/tag/v0.33.1
More from BuildKit
9.8
CVE-2026-33747
BuildKit vulnerable to malicious frontend causing file escape outside of storage root
9.8
CVE-2024-23653
BuildKit interactive containers API does not validate entitlements check
9.1
CVE-2024-23652
BuildKit possible host system access from mount stub cleaner
7.5
CVE-2026-93318
Cache poisoning via unvalidated image layer DiffIDs
7.5
CVE-2026-15793
Git source checkout from a bundle file could lead to command injection