CVE-2026-93326

A flaw was found in BuildKit. An attacker with the ability to define build steps can bypass policy validation rules by supplying a specially crafted Git source. During a clone operation, this issue allows the repository to spoof its remote URL, making untrusted source code appear to originate fro...

CVE-2026-93323

A flaw was found in BuildKit. A local user with build permissions can trigger a Denial of Service DoS by submitting a build context containing an oversized Dockerfile or .dockerignore file. Because the Dockerfile frontend loads these files directly into memory without enforcing a size limit, an...

CVE-2026-93315

A flaw was found in BuildKit. When proxy networking with Certificate Authority CA injection is enabled, a build can modify its CA certificate bundle before cleanup operations execute. A local user running a build can exploit this issue to cause the cleanup process to hang, resulting in a Denial o...

CVE-2026-93321

A flaw was found in BuildKit. A malicious build frontend can submit a crafted low-level builder LLB definition that triggers an unexpected panic in the BuildKit daemon. This issue leads to a Denial of Service DoS, causing the daemon process to crash and interrupting all active builds running on t...

CVE-2026-93318

A flaw was found in BuildKit. A remote attacker can supply a crafted container image that advertises layer identifiers matching another image without containing the actual layer contents. Because BuildKit does not validate that these identifiers match the layer data before caching them, a shared...

SUSE CVE-2026-93318

A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents. If a BuildKit daemon with...

Linux Distros Unpatched Vulnerability : CVE-2026-93318

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised...

Linux Distros Unpatched Vulnerability : CVE-2026-93320

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootfu...

Linux Distros Unpatched Vulnerability : CVE-2026-93319

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to...

Linux Distros Unpatched Vulnerability : CVE-2026-93316

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices. This can happen maliciously or by accident...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index through malformed LLB op validation in the solver’s SourceOp and DiffOp handling. An attacker can crash buildkitd by submitting a crafted LLB definition with an input/dependency count mismatch. The...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition in the containerd and runc executor run paths. An attacker can make a build succeed, block cleanup, or leave cleanup operating outside the intended rootfs by mutating the injected CA bundl...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition in the containerd and runc executor run paths. An attacker can make a build succeed, block cleanup, or leave cleanup operating outside the intended rootfs by mutating the injected CA bundl...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition in the containerd and runc executor run paths. An attacker can make a build succeed, block cleanup, or leave cleanup operating outside the intended rootfs by mutating the injected CA bundl...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition in the containerd and runc executor run paths. An attacker can make a build succeed, block cleanup, or leave cleanup operating outside the intended rootfs by mutating the injected CA bundl...

CVE-2026-93315

The BuildKit build engine is vulnerable to a Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) when using proxy networking with CA injection. A build step can modify the CA bundle before the cleanup process occurs, potentially causing the cleanup to block, execute outside the build root...

CVE-2026-93315 BuildKit proxy CA cleanup can be disrupted by build steps

When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build...

CVE-2026-93315 BuildKit proxy CA cleanup can be disrupted by build steps

When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build...

CVE-2026-93315 BuildKit proxy CA cleanup can be disrupted by build steps

When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build...

Incorrect Behavior Order: Validate Before Canonicalize

Overview Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize through the Source.Identifier path in source/git/source.go and source/git/identifier.go. An attacker can make a build appear to use a different Git remote URL than the one in the...