Description
When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build.
Published: 2026-10-05
Score: 5.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Disruption of CA cleanup may leave unauthorized certificates outside the build environment
Action: Apply Workaround
AI Analysis

Impact

When proxy networking with CA injection is enabled, a build can modify its CA bundle prior to cleanup. This can result in the cleanup process blocking, running outside the build root filesystem, or failing without causing the build to fail. The flaw is classified as CWE‑367, indicating improper cleanup of a resource.

Affected Systems

The moby BuildKit component is affected. No specific version ranges are listed in the advisory; users should consult the latest release notes for guidance.

Risk and Exploitability

The CVSS score of 5.8 classifies the vulnerability as moderate. EPSS score is not available, and it is not listed in the CISA KEV catalog. The likely attack vector is through build steps that enable proxy networking and alter the CA bundle. Exploitation requires the build environment to be configured for proxy networking and to modify the injected CA bundle. No evidence is presented of successful exploitation beyond the potential for residual certificates.

Generated by OpenCVE AI on October 6, 2026 at 00:05 UTC.

Remediation

Vendor Workaround

Avoid using build sources from untrusted locations. Only builds enabling proxy networking for exec steps (either via BuildKitd TOML config or Buildx Rego policy) are affected.

OpenCVE Recommended Actions

  • Apply the official workaround: avoid using build sources from untrusted locations and restrict builds that enable proxy networking for exec steps; only builds that use proxy networking are affected.
  • Upgrade to the latest stable BuildKit release (for example, v0.33.1 or later), which may resolve the cleanup issue.
  • If upgrading is not possible, monitor build logs for unexpected CA changes and consider implementing a manual cleanup step after each build to ensure certificates are removed.

Generated by OpenCVE AI on October 6, 2026 at 00:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 05 Oct 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Moby
Moby buildkit
Vendors & Products Moby
Moby buildkit

Mon, 05 Oct 2026 22:00:00 +0000

Type Values Removed Values Added
Description When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build.
Title BuildKit proxy CA cleanup can be disrupted by build steps
Weaknesses CWE-367
References
Metrics cvssV4_0

{'score': 5.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:N'}

Subscriptions

Moby Buildkit
cve-icon MITRE

Status: PUBLISHED

Assigner: Docker

Published:

Updated: 2026-10-06T13:27:23.994Z

Reserved: 2026-09-17T17:17:25.321Z

Link: CVE-2026-93315

cve-icon Vulnrichment

Updated: 2026-10-06T13:27:03.375Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-05T22:16:58.820

Modified: 2026-10-06T15:08:38.397

Link: CVE-2026-93315

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-06T00:15:05Z

Weaknesses
  • CWE-367

    Time-of-check Time-of-use (TOCTOU) Race Condition