CVE-2026-93320

MediumCVSS 6.0/10Last modified Oct 6, 2026

Description

BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access.

Metrics

CVSS 4.0 6.0/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-441

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 5, 2026
Last modified: Oct 6, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-933216.9A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daem CVE-2026-933226.9A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daem CVE-2026-933236.8The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context c CVE-2026-933266.0A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the CVE-2026-933304.3Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to byp CVE-2026-933317.3A vulnerability was identified in GPAC 26.08-DEV. This vulnerability affects the function gf_rtp_parse_ttxt of the file src/ietf/rtp_depacke CVE-2026-933325.4Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged us CVE-2026-933367.1Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal CVE-2026-933377.8NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN co CVE-2026-933385.3Grandstream GWN7660ELR before firmware version 1.0.27.6 contains an information disclosure vulnerability that allows unauthenticated remote CVE-2026-933395.4Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated us CVE-2026-93347.3Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled. decode_h