In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.
CVE-2026-121522 is a vulnerability in moby BuildKit versions 0.26.0 through 0.34.1 where a build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, disrupting builds. This issue is addressed in version 0.34.2.
CVE-2026-93321 is a medium severity vulnerability in moby BuildKit where improper validation of array indexes can cause the buildkitd daemon to panic and terminate. This occurs when a malicious frontend submits a crafted LLB definition, interrupting all builds running on that daemon.
CVE-2026-93315 is a medium severity vulnerability in moby BuildKit affecting versions from 0.31.0 up to but not including 0.33.1. It involves a time-of-check to time-of-use (TOCTOU) race condition when proxy networking with CA injection is enabled. This flaw allows a build process to modify its CA bundle before cleanup, potentially causing the cleanup operation to block, execute outside the intended build root filesystem, or fail without failing the build itself.
CVE-2026-93326 is a medium severity vulnerability in moby BuildKit affecting versions from 0 up to and including 0.33.0. It involves incorrect behavior order where validation occurs before canonicalization in a Git source build step. This flaw allows a malicious build definition to make a Git repository appear as if it originates from a different remote URL during cloning. However, stricter validations based on commit SHA, commit data, or signatures remain effective.
CVE-2026-93317 is a medium severity vulnerability in moby BuildKit where an unauthenticated attacker controlling a registry or OCI-layout blob source can supply blob contents that do not match the claimed digest. This can cause the snapshot to be cached incorrectly and reused in subsequent builds, compromising the integrity of build inputs. The affected versions are from 0.28.0 up to but not including 0.33.1.
CVE-2026-93320 is a medium severity vulnerability in moby BuildKit where the system may be tricked into performing file operations on special file inodes instead of regular files. This can cause operations to be blocked or, on rootful workers, allow unintended access to host devices. The issue arises from a confused deputy scenario where BuildKit mishandles file types during processing.
CVE-2026-93319 is a medium severity vulnerability in moby BuildKit versions up to 0.33.0. It involves unsynchronized access to shared data in a multi-threaded context, where a malicious external BuildKit frontend can send internal API requests that may cause a data race leading to a daemon panic.
A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents. If a BuildKit daemon with shared or persistent cache first processes such a malicious image, a later build using the victim image may mount the attacker-controlled layer contents as the base image. This can allow code from the malicious image to run in the victim build, for example by replacing a commonly executed path such as /bin/sh. The attacker-controlled code may read build secrets mounted into the build, access other build resources, alter output artifacts, or hang the build. The issue affects both regular snapshotters and lazy-pulling snapshotters such as stargz.
CVE-2026-93323 is a medium severity vulnerability in moby BuildKit where the Dockerfile frontend loads Dockerfile and .dockerignore files into memory without size limits. This can cause excessive memory allocation if a build context contains an oversized file, potentially exhausting memory and terminating the buildkitd daemon, disrupting other builds. The issue affects versions up to 0.33.0 and is fixed by rejecting files larger than 16 MiB.
CVE-2026-93322 is a medium severity vulnerability in moby BuildKit where improper validation of an array index can cause the buildkitd daemon to panic and terminate. This results in interruption of all builds running on the affected daemon. The vulnerability affects versions from 0 up to and including 0.33.0. There is no information about available patches or exploits in the wild.