Description
BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access.
Published: 2026-10-05
Score: 6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unintended host device access (possible privilege escalation)
Action: Apply Patch
AI Analysis

Impact

BuildKit incorrectly handles special file inodes during snapshot operations. When a build references a path that resolves to a special file instead of a regular file, BuildKit may perform actions assuming a regular file, causing file operations to be blocked or, on a rooted worker, granting unintended access to host devices. This can lead to denial of service or privilege escalation for the build process.

Affected Systems

BuildKit by moby is affected. Version information is not specified, but the advisory references the release v0.33.1 where the fix was applied.

Risk and Exploitability

The vulnerability carries a CVSS score of 6, indicating moderate severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. Attackers would need to supply an untrusted build that includes special file inodes; on rootful BuildKit workers this can lead to host device access, whereas on rootless workers the impact is limited to denial of service. Rootless mode mitigates device access but does not prevent denial of service. Updating to a patched version is the recommended mitigation.

Generated by OpenCVE AI on October 7, 2026 at 06:41 UTC.

Remediation

Vendor Workaround

Avoid untrusted builds. Rootless mode mitigates device access but not denial of service.

OpenCVE Recommended Actions

  • Update BuildKit to the latest version that includes the fix.
  • If an update is not possible, run untrusted build processes in rootless mode to prevent device access, noting that denial of service can still occur.
  • Avoid deploying builds that rely on special file inodes; validate build inputs to prevent inclusion of special files.

Generated by OpenCVE AI on October 7, 2026 at 06:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-66
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H'}

threat_severity

Important

Mon, 05 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Moby
Moby buildkit
Vendors & Products Moby
Moby buildkit

Mon, 05 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 05 Oct 2026 18:00:00 +0000

Type Values Removed Values Added
Description BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access.
Title BuildKit improperly handles special files in build snapshots
Weaknesses CWE-441
References
Metrics cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:H/SA:H'}

Subscriptions

Moby Buildkit
cve-icon MITRE

Status: PUBLISHED

Assigner: Docker

Published:

Updated: 2026-10-05T18:52:25.223Z

Reserved: 2026-09-17T17:18:00.217Z

Link: CVE-2026-93320

cve-icon Vulnrichment

Updated: 2026-10-05T18:52:16.741Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-05T18:17:38.353

Modified: 2026-10-06T15:08:38.397

Link: CVE-2026-93320

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-05T17:50:44Z

Links: CVE-2026-93320 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T06:45:13Z

Weaknesses
  • CWE-441

    Unintended Proxy or Intermediary ('Confused Deputy')

  • CWE-66

    Improper Handling of File Names that Identify Virtual Resources