CVE-2026-93315: BuildKit proxy CA cleanup can be disrupted by build steps
When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build.
Affected Software
Event History
Frequently Asked Questions
Which BuildKit configurations are affected?
The issue applies when proxy networking is enabled together with CA injection. Builds that do not use this combination are not identified as affected by the available information.
What must an attacker be able to do to trigger the issue?
The attacker needs the ability to run or influence build steps that modify the CA bundle before BuildKit performs its cleanup. The CVSS vector indicates local attack access and low privileges are required, with no user interaction required.
Can a failed cleanup be missed by normal build results?
Yes. Cleanup can fail without causing the build itself to fail, so a successful build result does not necessarily show that CA cleanup completed correctly.
What are the possible effects of disrupted cleanup?
Cleanup may block, fail, or operate outside the build root filesystem. The CVSS assessment identifies high availability impact and low integrity impact.