CVE-2026-93317

UNKNOWN

Description

An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity.

Timeline

Published:October 5th, 2026 6:17 PM

Last modified:October 5th, 2026 8:17 PM

CVSS Scoring

No CVSS v3 score available

Weaknesses (CWE)

CWE-354

References & Reports

Advisories, patches, and third-party reports

https://github.com/moby/buildkit/releases/tag/v0.33.1
https://github.com/moby/buildkit/security/advisories/GHSA-p3rc-w3hc-pqvv

Source: NIST NVD · Data may lag official sources by up to one minute