What’s Vulnerable › Vulnerabilities

CVE-2026-93321: Malformed LLB file operation can crash buildkitd

• Severity: medium (CVSS 6.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-05 · updated 2026-10-06
• Weakness: CWE-129

Description

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.

Affected products

• moby BuildKit: through 0.33.0

References

• https://github.com/moby/buildkit/releases/tag/v0.33.1
• https://github.com/moby/buildkit/security/advisories/GHSA-fjj4-h6vf-m9hj

Get alerted when CVE-2026-93321 or the next vulnerability affects your stack