CVE-2026-93317

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93317", "assignerOrgId": "686469e6-3ff6-451b-ab8b-cf5b9e89401e", "state": "PUBLISHED", "assignerShortName": "Docker", "dateReserved": "2026-09-17T17:17:43.718Z", "datePublished": "2026-10-05T17:43:44.903Z", "dateUpdated": "2026-10-05T19:06:09.645Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageName": "github.com/moby/buildkit", "product": "BuildKit", "vendor": "moby", "versions": [{"version": "0.28.0", "status": "affected", "lessThan": "0.33.1", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "He Wei (https://github.com/hewei-gikaku)"}, {"lang": "en", "type": "finder", "value": "Haoxiang Yan (https://github.com/Yanhaoxi)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity."}], "value": "An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity."}], "metrics": [{"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N", "baseScore": 5.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-354", "description": "CWE-354: Improper Validation of Integrity Check Value", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "686469e6-3ff6-451b-ab8b-cf5b9e89401e", "shortName": "Docker", "dateUpdated": "2026-10-05T17:43:44.903Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://github.com/moby/buildkit/security/advisories/GHSA-p3rc-w3hc-pqvv"}, {"tags": ["patch"], "url": "https://github.com/moby/buildkit/releases/tag/v0.33.1"}], "source": {"discovery": "EXTERNAL"}, "title": "Container blob cache can accept unverified content", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The issue only affects the low-level LLB API with direct blob access from the registry. It can't be reached with Dockerfile builds."}], "value": "The issue only affects the low-level LLB API with direct blob access from the registry. It can't be reached with Dockerfile builds."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-05T19:05:59.752463Z", "id": "CVE-2026-93317", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-05T19:06:09.645Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-93317", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-05T19:05:59.752463Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-05T19:06:05.861Z"}}], "cna": {"title": "Container blob cache can accept unverified content", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "He Wei (https://github.com/hewei-gikaku)"}, {"lang": "en", "type": "finder", "value": "Haoxiang Yan (https://github.com/Yanhaoxi)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "moby", "product": "BuildKit", "versions": [{"status": "affected", "version": "0.28.0", "lessThan": "0.33.1", "versionType": "semver"}], "packageName": "github.com/moby/buildkit", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/moby/buildkit/security/advisories/GHSA-p3rc-w3hc-pqvv", "tags": ["vendor-advisory"]}, {"url": "https://github.com/moby/buildkit/releases/tag/v0.33.1", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "The issue only affects the low-level LLB API with direct blob access from the registry. It can't be reached with Dockerfile builds.", "supportingMedia": [{"type": "text/html", "value": "The issue only affects the low-level LLB API with direct blob access from the registry. It can't be reached with Dockerfile builds.", "base64": false}]}], "descriptions": [{"lang": "en", "value": "An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity.", "supportingMedia": [{"type": "text/html", "value": "An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-354", "description": "CWE-354: Improper Validation of Integrity Check Value"}]}], "providerMetadata": {"orgId": "686469e6-3ff6-451b-ab8b-cf5b9e89401e", "shortName": "Docker", "dateUpdated": "2026-10-05T17:43:44.903Z"}}}, "cveMetadata": {"cveId": "CVE-2026-93317", "state": "PUBLISHED", "dateUpdated": "2026-10-05T19:06:09.645Z", "dateReserved": "2026-09-17T17:17:43.718Z", "assignerOrgId": "686469e6-3ff6-451b-ab8b-cf5b9e89401e", "datePublished": "2026-10-05T17:43:44.903Z", "assignerShortName": "Docker"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "github.com/moby/buildkit", "product": "BuildKit", "vendor": "moby", "versions": [{"lessThan": "0.33.1", "status": "affected", "version": "0.28.0", "versionType": "semver"}]}], "source": "security@docker.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity."}], "id": "CVE-2026-93317", "lastModified": "2026-10-06T15:08:38.397", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@docker.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-93317", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-05T19:05:59.752463Z", "version": "2.0.3"}}]}, "published": "2026-10-05T18:17:37.923", "references": [{"source": "security@docker.com", "url": "https://github.com/moby/buildkit/releases/tag/v0.33.1"}, {"source": "security@docker.com", "url": "https://github.com/moby/buildkit/security/advisories/GHSA-p3rc-w3hc-pqvv"}], "sourceIdentifier": "security@docker.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-354"}], "source": "security@docker.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/moby/buildkit: BuildKit: Build integrity compromise via unvalidated blob digest caching", "id": "2546011", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546011"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-354", "details": ["A flaw was found in BuildKit. An unauthenticated remote attacker controlling a container registry or Open Container Initiative (OCI) blob source can provide data that does not match its claimed cryptographic digest. Because BuildKit caches the resulting snapshot under the claimed digest, subsequent container builds may reuse the manipulated content, compromising build integrity."], "name": "CVE-2026-93317", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "buildah", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "podman", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "trivy", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-10-05T17:43:44Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93317\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93317\nhttps://github.com/moby/buildkit/releases/tag/v0.33.1\nhttps://github.com/moby/buildkit/security/advisories/GHSA-p3rc-w3hc-pqvv"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.28.0,0.33.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "BuildKit", "source": "cna", "vendor": "moby"}, "product": "buildkit", "vendor": "moby"}], "created": "2026-10-05T18:30:19.435015+00:00", "updated": "2026-10-05T19:00:15.520674+00:00", "vendors": ["moby", "moby$PRODUCT$buildkit"]}