Quick answers
- Is CVE-2026-93317 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-93317 being exploited in the wild.
- How severe is CVE-2026-93317?
- Informational severity, published 5 October 2026.
- Which products and versions are affected?
- Moby BuildKit 0.28.0 to 0.33.0.
- Is there a fix for CVE-2026-93317?
- Yes: fixed in buildkit v0.33.1 (and v0.32.3+). Until then: The vulnerability only affects the low-level LLB API with direct blob access from the registry and cannot be reached through standard Dockerfile builds, limiting exposure to advanced users with LLB API access. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-93317 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-93317?
- Check whether you run Moby BuildKit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: buildkit v0.33.1 (and v0.32.3+)
The vulnerability only affects the low-level LLB API with direct blob access from the registry and cannot be reached through standard Dockerfile builds, limiting exposure to advanced users with LLB API access.
Technical details
The vulnerability allows an authenticated client with raw LLB (low-level builder) API access to provide container blob contents from a registry or OCI layout that do not match the claimed digest. The unverified snapshot is then cached under that digest and reused by subsequent builds, bypassing integrity checks. The flaw affects buildkit versions 0.28.0 through 0.33.0 and is fixed by verifying blob contents against their claimed digest before caching.
Affected products
- moby buildkit 0.28.0 to 0.33.0
Timeline
- 2026-09-30: disclosed
- 2026-09-30: patched: v0.33.1 released