CVE-2026-93322

Summary

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.

Affected Software

Weaknesses

• CWE-129: CWE-129: Improper Validation of Array Index

Workarounds

Avoid using external BuildKit frontends from untrusted sources. Dockerfile builds are unaffected.

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/moby/buildkit/security/advisories/GHSA-cv6p-7w7g-xjwq
• https://github.com/moby/buildkit/releases/tag/v0.33.1

• ←Previous
• Next→