CVE-2026-93319

Summary

A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic.

Affected Software

Weaknesses

• CWE-567: CWE-567: Unsynchronized Access to Shared Data in a Multi-threaded Context

Workarounds

Avoid using external BuildKit frontends from untrusted sources. Dockerfile builds are unaffected.

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/moby/buildkit/security/advisories/GHSA-4hgw-qrhw-fhg8
• https://github.com/moby/buildkit/releases/tag/v0.33.1

• ←Previous
• Next→