CVE-2026-93317: CWE-354: Improper Validation of Integrity Check Value in moby BuildKit

This vulnerability (CWE-354) in moby BuildKit affects versions >=0.28.0 and <0.33.1. An attacker who controls a registry or OCI-layout blob source can provide blob contents that differ from the claimed digest. Because BuildKit improperly validates the integrity check value, the incorrect snapshot may be cached and reused by later builds, leading to compromised build-input integrity. The CVSS 4.0 score is 5.9 (medium severity), reflecting network attack vector, low attack complexity, partial attack requirement, no privileges required, user interaction needed, no confidentiality or availability impact, but high integrity impact, and limited scope and security impact.

The impact is a compromise of build-input integrity, meaning that subsequent builds may use tampered or malicious content cached under a trusted digest. This could lead to compromised build artifacts or supply chain risks. There is no indication of confidentiality or availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor official moby or BuildKit advisories for patches addressing this issue. Until a fix is available, caution is advised when using untrusted registries or blob sources.