Is CVE-2026-93318 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93318 being exploited in the wild.

How severe is CVE-2026-93318?

Informational severity, published 5 October 2026.

How is CVE-2026-93318 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-93318?

Check whether you run Moby BuildKit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93318: Moby BuildKit cache poisoning via unvalidated image layer DiffIDs

Q: Is there a fix for CVE-2026-93318?

Yes: fixed in BuildKit v0.33.1, v0.32.2 and later. Until then: Do not share BuildKit daemon cache between trusted and untrusted builds. Use isolated BuildKit daemons or ephemeral builders for untrusted image sources, or prune the BuildKit cache after processing untrusted images. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-93318 · Severity: info · Published 2026-10-05

BuildKit, a container image build tool, fails to validate that layer digests match actual layer contents. An attacker can craft a malicious image with mismatched layer digests that, when cached by a shared BuildKit daemon, causes subsequent legitimate builds to use the attacker's layer content as their base. This allows the attacker to inject code that steals build secrets, corrupts artifacts, or disrupts builds.

Technologies: Moby BuildKit. Vendors: Moby.

Quick answers

Is CVE-2026-93318 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93318 being exploited in the wild.
How severe is CVE-2026-93318?: Informational severity, published 5 October 2026.
Which products and versions are affected?: Moby BuildKit <= v0.33.0.
Is there a fix for CVE-2026-93318?: Yes: fixed in BuildKit v0.33.1, v0.32.2 and later. Until then: Do not share BuildKit daemon cache between trusted and untrusted builds. Use isolated BuildKit daemons or ephemeral builders for untrusted image sources, or prune the BuildKit cache after processing untrusted images. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-93318 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-93318?: Check whether you run Moby BuildKit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: BuildKit v0.33.1, v0.32.2 and later

Do not share BuildKit daemon cache between trusted and untrusted builds. Use isolated BuildKit daemons or ephemeral builders for untrusted image sources, or prune the BuildKit cache after processing untrusted images.

Technical details

BuildKit uses DiffIDs to derive cache and snapshot identity without verifying they match actual layer contents. An attacker can advertise DiffIDs from a legitimate image while providing different layer contents, poisoning the shared cache. When a subsequent build requests the victim image, BuildKit mounts the attacker-controlled layer, allowing arbitrary code execution in the build environment with access to secrets and resources. The vulnerability affects both regular and lazy-pulling (stargz) snapshotters.

Affected products

Moby BuildKit <= v0.33.0

Timeline

2026-09-30: disclosed
2026-09-30: patched: v0.33.1 released
2026-10-05: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.