CVE-2026-93315CWE-367

CVE-2026-93315

published October 6, 2026

CVSS
5.8
EPSS
0%
Percentile
0.7
In the wild
Unconfirmed
What it is

When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build.

The record
Technical detail
CVSS
5.8 · NONE
CVSS v4.0
5.8 · CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:N
EPSS
0.00096 · 0.7th percentile
Weakness
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition
Published
2026-10-06T02:16Z
References (2)
https://github.com/moby/buildkit/releases/tag/v0.33.1 · [email protected]https://github.com/moby/buildkit/security/advisories/GHSA-2f5p-x9ph-g97x · [email protected]
EPSS history
Timeline
  • 07 OCT 03:43Z
    EPSS moved — → 0%
    epss
  • 05 OCT 21:57Z
    BuildKit proxy CA cleanup can be disrupted by build steps
    cvelistv5