CVE-2026-93315: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition in moby BuildKit

This vulnerability is a TOCTOU race condition (CWE-367) in moby BuildKit's handling of proxy networking with CA injection. When enabled, a build can alter its CA bundle before the cleanup phase. This can lead to the cleanup process blocking, operating outside the build root filesystem, or failing silently without failing the build. The issue affects versions >=0.31.0 and <0.33.1. The CVSS 4.0 score is 5.8 (medium severity), reflecting local attack vector with low complexity and partial impact on availability and integrity.

An attacker with low privileges and the ability to influence the build process can cause the cleanup phase to malfunction. This may result in resource cleanup blocking indefinitely, cleanup actions occurring outside the intended build environment, or silent failures in cleanup. While the build itself does not fail, these side effects could lead to resource exhaustion or unintended persistence of modified CA bundles, potentially impacting system integrity and availability.

No vendor advisory or patch information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid enabling proxy networking with CA injection in affected versions or restrict build privileges to trusted users to minimize risk.