CVE-2026-93318

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-93318

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93318.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-93318

Aliases

GHSA-f2v9-hprr-32q3

Downstream

UBUNTU-CVE-2026-93318

Published

2026-10-05T17:45:39Z

Modified

2026-10-06T10:30:31Z

Severity

7.5 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

Cache poisoning via unvalidated image layer DiffIDs

Details

A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents.

If a BuildKit daemon with shared or persistent cache first processes such a malicious image, a later build using the victim image may mount the attacker-controlled layer contents as the base image. This can allow code from the malicious image to run in the victim build, for example by replacing a commonly executed path such as /bin/sh. The attacker-controlled code may read build secrets mounted into the build, access other build resources, alter output artifacts, or hang the build.

The issue affects both regular snapshotters and lazy-pulling snapshotters such as stargz.

Database specific

{
    "cna_assigner":  "Docker",
    "cwe_ids":  [
        "CWE-354"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93318.json"
}

References

Affected packages

Git / github.com/moby/buildkit

Affected ranges

Type

GIT

Repo

https://github.com/moby/buildkit

Events

Introduced

Fixed

8c91502cf280bd70a0c50912ce251c46a8881d9f

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "0.33.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

dockerfile/0.*

dockerfile/0.9.0

dockerfile/0.9.0-experimental

dockerfile/1.*

dockerfile/1.0.0

dockerfile/1.0.0-experimental

dockerfile/1.0.1

dockerfile/1.0.1-experimental

dockerfile/1.0.2-experimental

dockerfile/1.1.0

dockerfile/1.1.0-experimental

dockerfile/1.1.1

dockerfile/1.1.1-experimental

dockerfile/1.1.2

dockerfile/1.1.2-experimental

dockerfile/1.1.3

dockerfile/1.1.3-experimental

dockerfile/1.1.6

dockerfile/1.1.6-experimental

dockerfile/1.1.6-rc1

dockerfile/1.1.6-rc1-experimental

dockerfile/1.10.0-rc1

dockerfile/1.10.0-rc1-labs

dockerfile/1.11.0

dockerfile/1.11.0-labs

dockerfile/1.11.0-rc1

dockerfile/1.11.0-rc1-labs

dockerfile/1.11.0-rc2

dockerfile/1.11.0-rc2-labs

dockerfile/1.12.0

dockerfile/1.12.0-labs

dockerfile/1.12.0-rc1

dockerfile/1.12.0-rc1-labs

dockerfile/1.13.0-rc1

dockerfile/1.13.0-rc1-labs

dockerfile/1.14.0-rc1

dockerfile/1.14.0-rc1-labs

dockerfile/1.14.0-rc2

dockerfile/1.14.0-rc2-labs

dockerfile/1.15.0-rc1

dockerfile/1.15.0-rc1-labs

dockerfile/1.16.0-rc1

dockerfile/1.16.0-rc1-labs

dockerfile/1.17.0-rc1

dockerfile/1.17.0-rc1-labs

dockerfile/1.18.0-rc1

dockerfile/1.18.0-rc1-labs

dockerfile/1.18.0-rc2

dockerfile/1.18.0-rc2-labs

dockerfile/1.19.0-rc1

dockerfile/1.19.0-rc1-labs

dockerfile/1.2.0

dockerfile/1.2.0-labs

dockerfile/1.2.0-rc1

dockerfile/1.2.0-rc1-labs

dockerfile/1.2.1

dockerfile/1.2.1-labs

dockerfile/1.20.0

dockerfile/1.20.0-labs

dockerfile/1.20.0-rc1

dockerfile/1.20.0-rc1-labs

dockerfile/1.21.0-rc1

dockerfile/1.21.0-rc1-labs

dockerfile/1.22.0-rc1

dockerfile/1.22.0-rc1-labs

dockerfile/1.22.0-rc2

dockerfile/1.22.0-rc2-labs

dockerfile/1.23.0

dockerfile/1.23.0-labs

dockerfile/1.23.0-rc1

dockerfile/1.23.0-rc1-labs

dockerfile/1.24.0-rc1

dockerfile/1.24.0-rc1-labs

dockerfile/1.25.0

dockerfile/1.25.0-labs

dockerfile/1.25.0-rc1

dockerfile/1.25.0-rc1-labs

dockerfile/1.25.0-rc2

dockerfile/1.25.0-rc2-labs

dockerfile/1.26.0

dockerfile/1.26.0-labs

dockerfile/1.26.0-rc2

dockerfile/1.26.0-rc2-labs

dockerfile/1.27.0

dockerfile/1.27.0-labs

dockerfile/1.27.0-rc1

dockerfile/1.27.0-rc1-labs

dockerfile/1.3.0

dockerfile/1.3.0-labs

dockerfile/1.3.0-rc1

dockerfile/1.3.0-rc1-labs

dockerfile/1.4.0

dockerfile/1.4.0-labs

dockerfile/1.4.0-labs-rc1

dockerfile/1.4.0-labs-rc2

dockerfile/1.4.0-rc1

dockerfile/1.4.0-rc2

dockerfile/1.5.0-rc1

dockerfile/1.5.0-rc1-labs

dockerfile/1.5.0-rc2

dockerfile/1.5.0-rc2-labs

dockerfile/1.6.0

dockerfile/1.6.0-labs

dockerfile/1.6.0-rc1

dockerfile/1.6.0-rc1-labs

dockerfile/1.6.0-rc2

dockerfile/1.6.0-rc2-labs

dockerfile/1.7.0-rc1

dockerfile/1.7.0-rc1-labs

dockerfile/1.8.0

dockerfile/1.8.0-labs

dockerfile/1.8.0-rc1

dockerfile/1.8.0-rc1-labs

dockerfile/1.8.0-rc2

dockerfile/1.8.0-rc2-labs

dockerfile/1.9.0

dockerfile/1.9.0-labs

dockerfile/1.9.0-rc1

dockerfile/1.9.0-rc1-labs

dockerfile/1.9.0-rc2

dockerfile/1.9.0-rc2-labs

v0.*

v0.10.0

v0.10.0-rc1

v0.10.0-rc2

v0.11.0-rc1

v0.11.0-rc2

v0.11.0-rc3

v0.12.0

v0.12.0-rc1

v0.12.0-rc2

v0.13.0-beta1

v0.13.0-beta2

v0.13.0-beta3

v0.13.0-rc1

v0.13.0-rc2

v0.13.0-rc3

v0.14.0

v0.14.0-rc1

v0.14.0-rc2

v0.15.0

v0.15.0-rc1

v0.15.0-rc2

v0.16.0-rc1

v0.16.0-rc2

v0.17.0

v0.17.0-rc1

v0.17.0-rc2

v0.18.0

v0.18.0-rc1

v0.18.0-rc2

v0.19.0-rc1

v0.19.0-rc2

v0.19.0-rc3

v0.20.0-rc1

v0.20.0-rc2

v0.21.0-rc1

v0.22.0-rc1

v0.23.0-rc1

v0.24.0-rc1

v0.24.0-rc2

v0.25.0-rc1

v0.26.0

v0.26.0-rc1

v0.26.0-rc2

v0.27.0-rc1

v0.27.0-rc2

v0.28.0-rc1

v0.28.0-rc2

v0.29.0

v0.29.0-rc1

v0.3.0

v0.3.1

v0.3.2

v0.3.3

v0.30.0-rc1

v0.30.0-rc2

v0.31.0

v0.31.0-rc1

v0.31.0-rc2

v0.32.0

v0.32.0-rc1

v0.32.0-rc2

v0.33.0

v0.33.0-rc1

v0.33.0-rc2

v0.4.0

v0.5.0

v0.5.1

v0.6.0

v0.6.1

v0.7.0

v0.7.0-rc1

v0.8.0

v0.8.0-rc1

v0.8.0-rc2

v0.8.0-rc3

v0.8.1

v0.9.0

v0.9.0-rc1

v0.9.0-rc2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93318.json"