CVE-2026-93321

Malformed LLB file operation can crash buildkitd

View on CVE.org
Published Oct 5, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A malicious frontend can submit an LLB definition that causes buildkitd
to panic and terminate, interrupting all builds running on that daemon.

Analysis

AI-generated

Technical impact

A malicious BuildKit frontend can submit a specially crafted LLB (lower‑level build) definition that causes the buildkitd daemon to panic and terminate. This crash halts all builds currently running on that daemon, effectively denying service to any user relying on the daemon for container image builds.

Affected Systems

The vulnerability affects the Moby BuildKit suite. Any system running the BuildKit daemon and accepting non‑trusted frontends could be impacted. No specific version range is supplied in the advisory, so all versions that allow external frontends are potentially vulnerable.

Risk and Exploitability

The CVSS score of 6.9 indicates a medium severity risk. EPSS is not available, but the vulnerability is not listed in CISA’s KEV catalog, suggesting limited documented exploitation. The attack path requires an attacker to supply a malicious frontend or LLB file to buildkitd. An untrusted or compromised frontend can trigger the crash, causing a denial of build services. Because the daemon process stops, all pending builds are interrupted until the service is restarted.

Remediation

Vendor Workaround

Avoid using external BuildKit frontends from untrusted sources. Dockerfile builds are unaffected.

OpenCVE Recommended Actions

  • Upgrade BuildKit to the latest released that addresses this crash
  • Configure the daemon to allow only trusted frontends or disable external frontend support
  • Monitor buildkitd logs for crash events and plan for automatic restart or redundancy

Generated by OpenCVE AI on October 5, 2026 at 23:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Moby
Moby buildkit
Vendors & Products Moby
Moby buildkit
Type Values Removed Values Added
Description A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.
Title Malformed LLB file operation can crash buildkitd
Weaknesses CWE-129
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}
Weaknesses
  • CWE-129

    Improper Validation of Array Index

Sources

Status
PUBLISHED
Assigner
Docker
Published
Updated
Oct 6, 2026, 1:25 PM
Reserved
Sep 17, 2026, 5:18 PM

View source JSON

Updated
Oct 6, 2026, 1:25 PM

JSON

Status
Awaiting Analysis
Published
Oct 5, 2026, 10:16 PM
Modified
Oct 6, 2026, 3:08 PM

View source JSON

No data.

Updated
Oct 5, 2026, 11:45 PM

JSON