# CVE-2026-93319: Moby BuildKit data race in frontend API handling

Source: https://junglewise.ai/threats/cve-2026-93319-a-malicious-external-buildkit-frontend-can-send-requests-using  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-93319 · Severity: info · Published 2026-10-05

BuildKit is a container image build toolkit used by Docker and other container systems to compile and package application code. A malicious external build frontend can trigger a data race condition in the daemon that causes it to crash and become unavailable, disrupting all ongoing and future builds.

Technologies: [Moby BuildKit](https://junglewise.ai/threats/technologies/moby-buildkit). Vendors: [Moby](https://junglewise.ai/threats/vendors/moby).

## Quick answers

**Is CVE-2026-93319 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93319 being exploited in the wild.

**How severe is CVE-2026-93319?** Informational severity, published 5 October 2026.

**Which products and versions are affected?** Moby BuildKit <=v0.33.0.

**Is there a fix for CVE-2026-93319?** Yes: fixed in v0.33.1. Until then: Avoid using external BuildKit frontends from untrusted sources. Dockerfile builds are unaffected by this vulnerability.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-09-30"}, {"kind": "patched", "at": "2026-09-30"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-93319 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-93319?** Check whether you run Moby BuildKit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in v0.33.1

Avoid using external BuildKit frontends from untrusted sources. Dockerfile builds are unaffected by this vulnerability.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-09-30"}, {"kind": "patched", "at": "2026-09-30"}]

## Technical details

A data race in the BuildKit daemon's internal API request handling allows a malicious external frontend to send specially crafted requests that trigger a concurrent access condition, causing a daemon panic. The vulnerability affects BuildKit versions up to v0.33.0 and requires the use of an untrusted external frontend; Dockerfile builds are not affected. The fix is available in v0.33.1 and later.

## Affected products

- Moby BuildKit <=v0.33.0

## References

- [https://github.com/moby/buildkit/releases/tag/v0.33.1](https://github.com/moby/buildkit/releases/tag/v0.33.1)
- [https://github.com/moby/buildkit/security/advisories/GHSA-4hgw-qrhw-fhg8](https://github.com/moby/buildkit/security/advisories/GHSA-4hgw-qrhw-fhg8)

## Related threats

- [Moby BuildKit arbitrary extended attribute setting](https://junglewise.ai/threats/cve-2026-121520-in-buildkit-versions-prior-to-v0-34-1-a-malicious-client-with)
- [Moby BuildKit Git source resolver panic](https://junglewise.ai/threats/cve-2026-121522-in-buildkit-versions-v0-26-0-through-v0-34-1-a-specific-build)
- [Moby BuildKit malformed LLB merge operation denial of service](https://junglewise.ai/threats/cve-2026-93321-a-malicious-frontend-can-submit-an-llb-definition-that-causes)
- [Moby BuildKit proxy CA cleanup disruption](https://junglewise.ai/threats/cve-2026-93315-when-proxy-networking-with-ca-injection-is-enabled-a-build-can)
- [Moby BuildKit Git source policy validation bypass](https://junglewise.ai/threats/cve-2026-93326-a-build-step-for-a-git-source-crafted-in-a-specific-way-can)