Moby BuildKit CVE-2026-93315

Requires BuildKit to be running with proxy networking AND CA injection enabled - a non-default feature combination that must be explicitly configured. The attacker must also be able to submit or execute a build on the builder (PR:L) and win a race window (AT:P / TOCTOU) by modifying the build's CA bundle before BuildKit performs cleanup. Limiting factors: the local attack vector (AV:L) means this is not remotely reachable without build access, the dependence on the optional CA-injection proxy mode sharply narrows exposed deployments, and the primary consequence is denial/cleanup failure (VA:H) rather than confidentiality loss; multi-tenant or untrusted-build environments are the realistic risk surface.

This is a medium-severity (CVSS 4.0 base 5.8), low-urgency issue rather than a front-of-line priority. The vendor vector (CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:N) describes a locally-scoped (AV:L) flaw that requires an attacker to already be able to submit or run a build (PR:L) and to satisfy a specific attack requirement (AT:P) - consistent with the CWE-367 TOCTOU race described, where a build modifies its CA bundle in the window before cleanup. Impact is skewed toward availability (VA:H - cleanup blocking/hanging) with only limited integrity effect (VI:L, and SI:L reflecting cleanup acting outside the build rootfs); there is no confidentiality impact (VC:N). No EPSS score, SSVC decision data, KEV listing, or POC was provided, so exploitation probability signals are absent - this is no public exploit identified at time of analysis. A patch is confirmed available (v0.33.1). Note a caveat: exploitation is gated on a non-default feature combination (proxy networking with CA injection), so the raw CVSS can overstate real-world exposure; conversely, the described 'operate outside the build rootfs' behavior is a sandbox-boundary concern that defenders of multi-tenant builders should weigh more heavily than the medium score alone suggests.

On a shared or CI/CD BuildKit builder where proxy networking with CA injection is enabled, an attacker who can submit a crafted Dockerfile/build arranges for the build to rewrite its injected CA bundle just before BuildKit's cleanup phase. Winning this TOCTOU window causes cleanup to hang, fail silently, or perform filesystem operations outside the intended build rootfs. No public exploit code was identified at time of analysis; the attack requires the ability to run a build on the target (PR:L) and reliable timing (AT:P).