Is CVE-2026-93316 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93316 being exploited in the wild.

How severe is CVE-2026-93316?

Informational severity, published 5 October 2026.

Which products and versions are affected?

Moby Project BuildKit <= v0.33.0.

How is CVE-2026-93316 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-93316?

Check whether you run Moby Project BuildKit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93316: BuildKit daemon panic when CDI disabled flag is used

Q: Is there a fix for CVE-2026-93316?

Yes: fixed in v0.32.3, v0.33.1. Until then: The issue only manifests when --cdi-disabled is explicitly set as a startup flag or in TOML config. Do not use this flag, or restrict access to the BuildKit daemon to trusted builders only. Without the flag, builds that request CDI devices fail cleanly with entitlement checks. [{"kind":"disclosed","at":"2026-09-30"},{"kind":"patched","at":"2026-09-30"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-93316 · Severity: info · Published 2026-10-05

BuildKit is a container image build tool used in CI/CD pipelines and container development. If the daemon is started with the --cdi-disabled flag, a malicious or accidental build request attempting to use CDI (Container Device Interface) devices can crash the daemon, causing service disruption for all builds running on that daemon.

Technologies: Moby Project BuildKit. Vendors: Moby Project.

Quick answers

Is CVE-2026-93316 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93316 being exploited in the wild.
How severe is CVE-2026-93316?: Informational severity, published 5 October 2026.
Which products and versions are affected?: Moby Project BuildKit <= v0.33.0.
Is there a fix for CVE-2026-93316?: Yes: fixed in v0.32.3, v0.33.1. Until then: The issue only manifests when --cdi-disabled is explicitly set as a startup flag or in TOML config. Do not use this flag, or restrict access to the BuildKit daemon to trusted builders only. Without the flag, builds that request CDI devices fail cleanly with entitlement checks.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-09-30"},{"kind":"patched","at":"2026-09-30"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-93316 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-93316?: Check whether you run Moby Project BuildKit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: v0.32.3, v0.33.1

The issue only manifests when --cdi-disabled is explicitly set as a startup flag or in TOML config. Do not use this flag, or restrict access to the BuildKit daemon to trusted builders only. Without the flag, builds that request CDI devices fail cleanly with entitlement checks.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-09-30"},{"kind":"patched","at":"2026-09-30"}]

Technical details

A daemon panic occurs in BuildKit when the --cdi-disabled flag is set and builds attempt to use CDI devices. The vulnerability requires low privileges and network access but does not affect confidentiality or integrity—only daemon availability. The issue is fixed in v0.32.3 and later.

Affected products

Moby Project BuildKit <= v0.33.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.