moby BuildKit up to 0.33.0 Digest Verification integrity check

Summaryinfo

A vulnerability classified as critical was found in moby BuildKit up to 0.33.0. The affected element is an unknown function of the component Digest Verification. Such manipulation leads to integrity check. This vulnerability is uniquely identified as CVE-2026-93317. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in moby BuildKit up to 0.33.0 and classified as critical. Affected by this issue is an unknown function of the component Digest Verification. The manipulation with an unknown input leads to a integrity check vulnerability. Using CWE to declare the problem leads to CWE-353. The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum. Impacted is integrity, and availability. CVE summarizes:

An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-93317 since 09/17/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available.

Upgrading to version 0.33.1 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• moby

Name

• BuildKit

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32
• 0.33.0

Website

• Product: https://github.com/moby/buildkit/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion