BuildKit CVE-2026-93318

Exploitation requires a BuildKit daemon configured with a shared or persistent cache (e.g. a multi-tenant or long-lived CI/build farm) - ephemeral, non-shared caches are not affected. The attacker must get their malicious image processed by the daemon BEFORE the victim build runs, so that the forged DiffIDs seed the cache/snapshot store, and a victim must then execute a build that references the targeted base image (UI:A). The flaw affects both regular snapshotters and lazy-pulling snapshotters such as stargz. Limiting factors: the required ordering/shared-state precondition (reflected as AT:P) and the need for a victim build to occur mean this is not a one-shot remote hit against a default single-tenant builder.

This is a genuine integrity/supply-chain flaw (CWE-354) in BuildKit, but it is a conditional cache-poisoning issue rather than a trivially remote RCE. The supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:L) is internally consistent with the description: AT:P (attack requirement) captures the mandatory ordering/state precondition that the daemon must first ingest the malicious image into a shared or persistent cache, and UI:A captures that a victim must subsequently run a build. Impact is correctly rated high on confidentiality and integrity (build secrets can be read and output artifacts altered) with low availability (the build can be hung). No EPSS score, KEV listing, or POC was provided in the input, so there is no signal of active or widespread exploitation - no public exploit identified at time of analysis. Net: a real priority for multi-tenant / shared-cache CI environments and build farms, but lower practical risk for single-tenant builders with ephemeral, non-shared caches. The precondition (attacker image processed first on a shared cache) means realistic exploitation is targeted/environment-specific rather than opportunistic, which is consistent with the absence of mass-exploitation signals.

In a shared multi-tenant CI build farm running a BuildKit daemon with a shared or persistent cache, an attacker first submits a crafted image that advertises DiffIDs belonging to a legitimate base image while shipping different layer contents. When a victim pipeline later builds using that base image, BuildKit derives cache/snapshot identity from the advertised DiffIDs and mounts the attacker's layer, so attacker code (e.g. a replaced /bin/sh) executes inside the victim build and can exfiltrate mounted build secrets or tamper with output artifacts. No public exploit was provided in the input.