# CVE-2026-93315: Moby BuildKit proxy CA cleanup disruption

Source: https://junglewise.ai/threats/cve-2026-93315-when-proxy-networking-with-ca-injection-is-enabled-a-build-can  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-93315 · Severity: info · Published 2026-10-05

BuildKit is a container build system that can inject certificate authorities into builds when proxy networking is enabled. A malicious build step can modify the CA bundle before cleanup, causing the cleanup process to block, access files outside the build environment, or fail silently without stopping the build.

Technologies: [Moby BuildKit](https://junglewise.ai/threats/technologies/moby-buildkit). Vendors: [Moby](https://junglewise.ai/threats/vendors/moby).

## Quick answers

**Is CVE-2026-93315 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93315 being exploited in the wild.

**How severe is CVE-2026-93315?** Informational severity, published 5 October 2026.

**Which products and versions are affected?** Moby BuildKit >= 0.31.0.

**Is there a fix for CVE-2026-93315?** Yes: fixed in v0.33.1. Until then: Avoid using build sources from untrusted locations. Only builds enabling proxy networking for exec steps (either via BuildKitd TOML configuration or Buildx Rego policy) are affected.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-09-30", "note": "GitHub security advisory GHSA-2f5p-x9ph-g97x published"}, {"kind": "patched", "at": "2026-09-30", "note": "Fixed in v0.33.1 release"}, {"kind": "advisory", "at": "2026-10-05"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-93315 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-93315?** Check whether you run Moby BuildKit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in v0.33.1

Avoid using build sources from untrusted locations. Only builds enabling proxy networking for exec steps (either via BuildKitd TOML configuration or Buildx Rego policy) are affected.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-09-30", "note": "GitHub security advisory GHSA-2f5p-x9ph-g97x published"}, {"kind": "patched", "at": "2026-09-30", "note": "Fixed in v0.33.1 release"}, {"kind": "advisory", "at": "2026-10-05"}]

## Technical details

When proxy networking with CA injection is enabled (via BuildKitd configuration or Buildx policy), build steps execute within a rootfs that includes an injected CA bundle. A build can modify this CA bundle before cleanup runs, potentially causing the cleanup process to redirect outside the build rootfs, be blocked by specially-crafted files, or fail without failing the build itself. The vulnerability requires proxy networking for exec steps to be enabled and affects BuildKit versions 0.31.0 and later.

## Affected products

- Moby BuildKit >= 0.31.0

## References

- [https://github.com/moby/buildkit/releases/tag/v0.33.1](https://github.com/moby/buildkit/releases/tag/v0.33.1)
- [https://github.com/moby/buildkit/security/advisories/GHSA-2f5p-x9ph-g97x](https://github.com/moby/buildkit/security/advisories/GHSA-2f5p-x9ph-g97x)

## Related threats

- [Moby BuildKit arbitrary extended attribute setting](https://junglewise.ai/threats/cve-2026-121520-in-buildkit-versions-prior-to-v0-34-1-a-malicious-client-with)
- [Moby BuildKit Git source resolver panic](https://junglewise.ai/threats/cve-2026-121522-in-buildkit-versions-v0-26-0-through-v0-34-1-a-specific-build)
- [Moby BuildKit malformed LLB merge operation denial of service](https://junglewise.ai/threats/cve-2026-93321-a-malicious-frontend-can-submit-an-llb-definition-that-causes)
- [Moby BuildKit Git source policy validation bypass](https://junglewise.ai/threats/cve-2026-93326-a-build-step-for-a-git-source-crafted-in-a-specific-way-can)
- [Moby buildkit Dockerfile memory exhaustion via oversized files](https://junglewise.ai/threats/cve-2026-93323-the-dockerfile-frontend-loaded-the-dockerfile-and-dockerignore)