Is CVE-2026-93315 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93315 being exploited in the wild.

How severe is CVE-2026-93315?

Informational severity, published 5 October 2026.

Is there a fix for CVE-2026-93315?

Yes: fixed in v0.33.1. Until then: Avoid using build sources from untrusted locations. Only builds enabling proxy networking for exec steps (either via BuildKitd TOML configuration or Buildx Rego policy) are affected. [{"kind": "disclosed", "at": "2026-09-30", "note": "GitHub security advisory GHSA-2f5p-x9ph-g97x published"}, {"kind": "patched", "at": "2026-09-30", "note": "Fixed in v0.33.1 release"}, {"kind": "advisory", "at": "2026-10-05"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-93315 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-93315?

Check whether you run Moby BuildKit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93315: Moby BuildKit proxy CA cleanup disruption

CVE-2026-93315 · Severity: info · Published 2026-10-05

BuildKit is a container build system that can inject certificate authorities into builds when proxy networking is enabled. A malicious build step can modify the CA bundle before cleanup, causing the cleanup process to block, access files outside the build environment, or fail silently without stopping the build.

Technologies: Moby BuildKit. Vendors: Moby.

Quick answers

Is CVE-2026-93315 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93315 being exploited in the wild.
How severe is CVE-2026-93315?: Informational severity, published 5 October 2026.
Which products and versions are affected?: Moby BuildKit >= 0.31.0.
Is there a fix for CVE-2026-93315?: Yes: fixed in v0.33.1. Until then: Avoid using build sources from untrusted locations. Only builds enabling proxy networking for exec steps (either via BuildKitd TOML configuration or Buildx Rego policy) are affected.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-09-30", "note": "GitHub security advisory GHSA-2f5p-x9ph-g97x published"}, {"kind": "patched", "at": "2026-09-30", "note": "Fixed in v0.33.1 release"}, {"kind": "advisory", "at": "2026-10-05"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-93315 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-93315?: Check whether you run Moby BuildKit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: v0.33.1

Avoid using build sources from untrusted locations. Only builds enabling proxy networking for exec steps (either via BuildKitd TOML configuration or Buildx Rego policy) are affected.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-09-30", "note": "GitHub security advisory GHSA-2f5p-x9ph-g97x published"}, {"kind": "patched", "at": "2026-09-30", "note": "Fixed in v0.33.1 release"}, {"kind": "advisory", "at": "2026-10-05"}]

Technical details

When proxy networking with CA injection is enabled (via BuildKitd configuration or Buildx policy), build steps execute within a rootfs that includes an injected CA bundle. A build can modify this CA bundle before cleanup runs, potentially causing the cleanup process to redirect outside the build rootfs, be blocked by specially-crafted files, or fail without failing the build itself. The vulnerability requires proxy networking for exec steps to be enabled and affects BuildKit versions 0.31.0 and later.

Affected products

Moby BuildKit >= 0.31.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.