CVE-2026-93318: CWE-354: Improper Validation of Integrity Check Value in moby BuildKit

The vulnerability arises because BuildKit uses advertised DiffIDs to derive cache and snapshot identity without verifying that these DiffIDs match the actual layer contents. If a BuildKit daemon with shared or persistent cache processes a malicious image exploiting this flaw, a later build using the victim image may mount attacker-controlled layer contents as the base image. This can lead to execution of attacker-controlled code within the build environment, including replacing commonly executed paths such as /bin/sh. Both regular and lazy-pulling snapshotters like stargz are affected. The CVSS 4.0 score is 7.5, indicating high severity.

An attacker can cause BuildKit to use malicious layer contents during a build, potentially executing arbitrary code in the build environment. This can lead to unauthorized access to build secrets, manipulation of build resources, alteration of output artifacts, or denial of service by hanging the build process. The vulnerability affects the integrity of the build process and can compromise the security of container images built with affected versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using shared or persistent caches with untrusted images and consider isolating build environments to reduce risk. Monitor vendor channels for updates and apply patches promptly once released.