CVE-2026-93326: Crafted Git build source can bypass certain policy validation
A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look like it is coming from a different remote URL than it really is when Git clone is happening. If policy is doing more stricter validation, for example based on commit SHA, commit data, or signatures, then all these validations still apply correctly.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
BuildKit users are exposed when they apply policy validation rules to Git remote URLs during Git-based builds. The issue is relevant where untrusted parties can supply or influence build definitions.
What does an attacker need to exploit it?
An attacker needs to provide a malicious build definition containing a specifically crafted Git build source. During cloning, this can cause the repository to appear to originate from a different remote URL than its actual source.
Which policy checks remain effective?
Stricter validation based on the commit SHA, commit data, or signatures continues to apply correctly. The bypass affects certain policy validation rules tied to the apparent remote URL.
What should teams do if they cannot update immediately?
Do not rely solely on Git remote-URL policy checks for untrusted build definitions. Use commit SHA, commit metadata, or signature-based validation, which the advisory states still works correctly.