Skip to content
OpenAdvisories
High WID-SEC-2026-3741 10 CVEs

BuildKit: Mehrere Schwachstellen

Published Oct 5, 2026 · Updated Oct 25, 2026 · Revision 2 · de-DE

Vendor: amazon Product: Linux 2

Summary

Ein Angreifer kann mehrere Schwachstellen in BuildKit ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen sowie einen Denial-of-Service-Zustand auszulösen.

Product

BuildKit ist ein Open-Source-Toolkit zum effizienten und sicheren Erstellen von Container-Images, das erweiterte Funktionen wie parallele Build-Ausführung, Caching und Erweiterbarkeit bietet.

Vulnerabilities 10

  • High 7.5
    CVE-2026-93318

    Cache poisoning via unvalidated image layer DiffIDs

    A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer c…

    moby BuildKit docker.io moby-engine Ubuntu Azure Linux
  • High 7.1
    CVE-2026-93316

    Starting daemon with --cdi-disabled flag can lead to panic on specific builds

    If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices. This can happen maliciously or by accident.

    moby BuildKit docker.io docker.io-app Ubuntu
  • Medium 6.9
    CVE-2026-93321

    Malformed LLB file operation can crash buildkitd

    A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.

    moby BuildKit docker.io moby-engine Ubuntu Azure Linux
  • Medium 6.9
    CVE-2026-93322

    Malformed MergeOp can crash the BuildKit daemon

    A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.

    moby BuildKit docker.io moby-engine Ubuntu Azure Linux
  • Medium 6.8
    CVE-2026-93323

    Oversized Dockerfile or .dockerignore can exhaust buildkitd memory

    The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing an oversized file could make buildkitd allocate memory proportional to that file, potentially exhausting memo…

    moby BuildKit docker.io moby-engine Ubuntu Azure Linux
  • Medium 6.0
    CVE-2026-93320

    BuildKit improperly handles special files in build snapshots

    BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access.

    moby BuildKit docker.io moby-engine Ubuntu Azure Linux
  • Medium 6.0
    CVE-2026-93326

    Crafted Git build source can bypass certain policy validation

    A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look like it is coming from a different remote URL than it really is when Git clone is happening. If policy…

    moby BuildKit docker.io moby-engine Ubuntu Azure Linux
  • Medium 5.9
    CVE-2026-93317

    Container blob cache can accept unverified content

    An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-inp…

    moby BuildKit docker.io docker.io-app Ubuntu
  • Medium 5.8
    CVE-2026-93315

    BuildKit proxy CA cleanup can be disrupted by build steps

    When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build.

    moby BuildKit docker.io docker.io-app Ubuntu
  • Medium 5.7
    CVE-2026-93319

    A malicious frontend can cause a daemon panic

    A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic.

    moby BuildKit docker.io moby-engine Ubuntu Azure Linux

Revision history

  1. #2

    Neue Updates von Amazon aufgenommen

  2. #1

    Initiale Fassung

References