CVE-2026-93317: Container blob cache can accept unverified content

Severity: medium (CVSS 5.9 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-05 · updated 2026-10-06
Weakness: CWE-354

Description

An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity.

Affected products

moby BuildKit: from 0.28.0 before 0.33.1 — fixed in 0.33.1

How to fix

Upgrade to a fixed version: moby BuildKit 0.33.1. Check the vendor advisory for mitigations.

References

https://github.com/moby/buildkit/releases/tag/v0.33.1
https://github.com/moby/buildkit/security/advisories/GHSA-p3rc-w3hc-pqvv

Get alerted when CVE-2026-93317 or the next vulnerability affects your stack