CVE-2026-93317
Description
A flaw was found in BuildKit. An unauthenticated remote attacker controlling a container registry or Open Container Initiative (OCI) blob source can provide data that does not match its claimed cryptographic digest. Because BuildKit caches the resulting snapshot under the claimed digest, subsequent container builds may reuse the manipulated content, compromising build integrity.
Statement
A flaw was found in BuildKit's snapshot caching mechanism when pulling container blobs from remote registries or OCI-layout sources. BuildKit fails to verify that downloaded blob data matches its advertised cryptographic digest before creating and caching the snapshot. A remote attacker controlling a registry or blob source can supply manipulated contents under a valid digest, causing BuildKit to cache poisoned layers. Subsequent builds referencing that digest reuse the tampered layer, compromising build artifact integrity.
Mitigation
Configure BuildKit to pull images and blobs exclusively from trusted, authenticated registries. Avoid sharing build daemon cache instances across untrusted workloads and regularly prune cached snapshots.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | Required | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Understanding the Weakness (CWE)
Integrity,Other
Technical Impact: Modify Application Data; Other
Integrity checks usually use a secret key that helps authenticate the data origin. Skipping integrity checking generally opens up the possibility that new data from an invalid source can be injected.
Integrity,Other
Technical Impact: Other
Data that is parsed and used may be corrupted.
Non-Repudiation,Other
Technical Impact: Hide Activities; Other
Without a checksum check, it is impossible to determine if any changes have been made to the data after it was sent.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
