CVE-2026-93315

MediumCVSS 5.8/10Last modified Oct 6, 2026

Description

When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build.

Metrics

CVSS 4.0 5.8/10

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-367

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 5, 2026
Last modified: Oct 6, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-933167.1If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices. This can happen maliciousl CVE-2026-933175.9An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed dige CVE-2026-933187.5A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could u CVE-2026-933195.7A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause th CVE-2026-933206.0BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block oper CVE-2026-933216.9A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daem CVE-2026-933226.9A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daem CVE-2026-933236.8The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context c CVE-2026-933266.0A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the CVE-2026-933304.3Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to byp CVE-2026-933317.3A vulnerability was identified in GPAC 26.08-DEV. This vulnerability affects the function gf_rtp_parse_ttxt of the file src/ietf/rtp_depacke CVE-2026-933325.4Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged us