CVE-2026-93315: BuildKit proxy CA cleanup can be disrupted by build steps

Severity: medium (CVSS 5.8 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-05 · updated 2026-10-06
Weakness: CWE-367

Description

When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build.

Affected products

moby BuildKit: from 0.31.0 before 0.33.1 — fixed in 0.33.1

How to fix

Upgrade to a fixed version: moby BuildKit 0.33.1. Check the vendor advisory for mitigations.

References

https://github.com/moby/buildkit/releases/tag/v0.33.1
https://github.com/moby/buildkit/security/advisories/GHSA-2f5p-x9ph-g97x

Get alerted when CVE-2026-93315 or the next vulnerability affects your stack