6.0
Medium
CVE-2026-93320 BuildKit may be tricked into performing file actions with special file inodes where regular files are expected
Description
BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| buildkit 0.33 | earliest → 0.33.0 | No fix stated |
References
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of buildkit
The 27 CVEs of buildkit →
CVE-2026-121520
Malicious client could set xattr value outside of BuildKit state directory
4.5
Medium
CVE-2026-121522
Possible panic from Git source resolver
6.7
Medium
CVE-2026-93321
A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all…
6.9
Medium
CVE-2026-93315
When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup
5.8
Medium