CVE-2026-93319: A malicious frontend can cause a daemon panic

Severity: medium (CVSS 5.7 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-05 · updated 2026-10-06
Weakness: CWE-567

Description

A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic.

Affected products

moby BuildKit: through 0.33.0

References

https://github.com/moby/buildkit/releases/tag/v0.33.1
https://github.com/moby/buildkit/security/advisories/GHSA-4hgw-qrhw-fhg8

Get alerted when CVE-2026-93319 or the next vulnerability affects your stack