CVE-2026-93317: Container blob cache can accept unverified content
An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
BuildKit users are exposed when a build obtains blobs from a registry or OCI-layout source controlled by an unauthenticated attacker. A later victim build can reuse the poisoned cached snapshot under the claimed digest.
What does an attacker need to exploit it?
The attacker needs control of a registry or OCI-layout blob source and must be able to provide blob content that differs from its claimed digest. No authentication is required for the attacker according to the advisory description.
What is the impact on affected builds?
A mismatched blob can be cached under its claimed digest, allowing it to be reused by a subsequent build. This compromises the integrity of build inputs.
What remediation information is available?
The provided release reference identifies BuildKit v0.33.1. The supplied data does not state affected versions, fixed-version scope, or temporary mitigations.