File Handling Vulnerability in BuildKit by Moby
CVE-2026-93320

6MEDIUM

Key Information:

Vendor

Moby

Status
Buildkit
Vendor
CVE Published:
5 October 2026

What is CVE-2026-93320?

BuildKit by Moby may be manipulated to execute file operations involving special file inodes instead of regular files. This flaw can disrupt normal functionalities or, in configurations with rootful workers, potentially permit unauthorized access to host devices, thereby posing security risks.

Affected Version(s)

BuildKit 0 <= 0.33.0

References

https://github.com/moby/buildkit/security/advisories/GHSA...
vendor-advisory
https://github.com/moby/buildkit/releases/tag/v0.33.1
patch

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Daniele Linguaglossa (https://github.com/dzonerzy)
.