What’s Vulnerable › Vulnerabilities

CVE-2026-93322: Malformed MergeOp can crash the BuildKit daemon

• Severity: medium (CVSS 6.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-05 · updated 2026-10-06
• Weakness: CWE-129

Description

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.

Affected products

• moby BuildKit: through 0.33.0

References

• https://github.com/moby/buildkit/releases/tag/v0.33.1
• https://github.com/moby/buildkit/security/advisories/GHSA-cv6p-7w7g-xjwq

Get alerted when CVE-2026-93322 or the next vulnerability affects your stack