CVE-2026-93320

BuildKit improperly handles special files in build snapshots

Published Oct 5, 2026 CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Description

BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access.

Analysis

Technical impact

BuildKit incorrectly handles special file inodes during snapshot operations. When a build references a path that resolves to a special file instead of a regular file, BuildKit may perform actions assuming a regular file, causing file operations to be blocked or, on a rooted worker, granting unintended access to host devices. This can lead to denial of service or privilege escalation for the build process.

Affected Systems

BuildKit by moby is affected. Version information is not specified, but the advisory references the release v0.33.1 where the fix was applied.

Risk and Exploitability

The vulnerability carries a CVSS score of 6, indicating moderate severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. Attackers would need to supply an untrusted build that includes special file inodes; on rootful BuildKit workers this can lead to host device access, whereas on rootless workers the impact is limited to denial of service. Rootless mode mitigates device access but does not prevent denial of service. Updating to a patched version is the recommended mitigation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

moby

BuildKit

unaffected

Version	Status	Constraints
`0`	affected	≤ 0.33.0

No data.

Vendor Product Versions

Moby

Buildkit

Version	Status	Scheme	Platform
`[0,0.33.0]`	affected	generic	—

Remediation

Vendor Workaround

Avoid untrusted builds. Rootless mode mitigates device access but not denial of service.

OpenCVE Recommended Actions

Update BuildKit to the latest version that includes the fix.
If an update is not possible, run untrusted build processes in rootless mode to prevent device access, noting that denial of service can still occur.
Avoid deploying builds that rely on special file inodes; validate build inputs to prevent inclusion of special files.

Generated by OpenCVE AI on October 7, 2026 at 06:41 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.114% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/moby/buildkit/releases/tag/v0.33.1
https://github.com/moby/buildkit/security/advisories/GHSA-9728-qjrv-2xh2
https://nvd.nist.gov/vuln/detail/CVE-2026-93320
https://www.cve.org/CVERecord?id=CVE-2026-93320

History

Oct 6, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-66
References		https://nvd.nist.gov/vuln/detail/CVE-2026-93320 https://www.cve.org/CVERecord?id=CVE-2026-93320
Metrics	threat_severity `None`	cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H'}` threat_severity `Important`

Oct 5, 2026 9:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Moby Moby buildkit
Vendors & Products		Moby Moby buildkit

Oct 5, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 5, 2026 6:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access.
Title		BuildKit improperly handles special files in build snapshots
Weaknesses		CWE-441
References		https://github.com/moby/buildkit/releases/tag/v0.33.1 https://github.com/moby/buildkit/security/advisories/GHSA-9728-qjrv-2xh2
Metrics		cvssV4_0 `{'score': 6, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:H/SA:H'}`