CVE-2026-93326 Overview
CVE-2026-93326 affects Moby BuildKit, the toolkit used to build container images from source definitions. A specially crafted build step for a Git source can bypass certain policy validation rules. The flaw allows a malicious build definition to misrepresent the remote URL of a repository during a git clone operation. Policy engines relying on repository URL checks may evaluate the build against the wrong source. This vulnerability is tracked under [CWE-180: Incorrect Behavior Order: Validate Before Canonicalize]. The issue is addressed in BuildKit v0.33.1 according to the GitHub Security Advisory GHSA-66hf-6vf5-87hc.
Critical Impact
Attackers with permission to submit build definitions can trick URL-based policy checks into trusting repositories they should reject, enabling supply-chain tampering of container builds.
Affected Products
- Moby BuildKit prior to v0.33.1
- Container build pipelines consuming BuildKit as a backend
- CI/CD systems using BuildKit with URL-based admission policies
Discovery Timeline
- 2026-10-05 - CVE-2026-93326 published to NVD
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-93326
Vulnerability Analysis
BuildKit accepts a Git repository as a build source and clones it before executing build steps. Policy engines commonly validate the remote URL to decide whether a build is permitted. The vulnerability allows a crafted build step to make the repository appear to originate from a different remote URL than the one actually fetched during git clone. Policies that make trust decisions based solely on the stated remote URL will evaluate the build against the wrong identifier.
Stricter policy controls that validate commit SHA, commit metadata, or signatures remain effective. Those checks operate on the actual repository contents rather than the asserted remote URL. The failure mode is specifically in URL-based validation, not in cryptographic verification of commit integrity.
Root Cause
The issue maps to [CWE-180], Incorrect Behavior Order: Validate Before Canonicalize. BuildKit evaluates the Git source attributes before normalizing or reconciling them with the URL used for the actual clone. An attacker can structure the build definition so the validated URL and the fetched URL differ, producing a time-of-check to time-of-use mismatch between policy evaluation and repository retrieval.
Attack Vector
An attacker needs the ability to submit or influence a build definition that is processed by BuildKit. The attacker crafts a Git source entry that passes URL-based policy validation while causing BuildKit to clone a different remote. The resulting build operates on attacker-controlled source code even though the policy engine recorded a trusted origin. See the vendor advisory for the technical details of the bypass primitive.
No verified public exploit code is available for this issue.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-93326
Indicators of Compromise
- BuildKit build logs showing a clone from a remote URL that does not match the policy-approved source URL.
- Container images produced by builds whose recorded source URL cannot be reconciled with the fetched commit history.
- Unexpected outbound Git traffic from BuildKit workers to repositories not on the organizational allowlist.
Detection Strategies
- Compare the Git source URL declared in build definitions against the actual URL recorded in BuildKit worker network telemetry.
- Validate every build artifact against commit SHA and signature evidence rather than the submitted remote URL.
- Inventory BuildKit versions across build infrastructure and flag any instance earlier than v0.33.1.
Monitoring Recommendations
- Enable verbose BuildKit logging to capture resolved Git source parameters for each build.
- Forward CI/CD and container build logs to a centralized analytics platform to correlate declared versus fetched Git remotes.
- Alert on policy evaluations that approve a build whose downstream clone targets a different host, path, or protocol.
How to Mitigate CVE-2026-93326
Immediate Actions Required
- Upgrade BuildKit to v0.33.1 or later across all build workers and CI runners.
- Audit recent builds for discrepancies between declared source URLs and actual cloned repositories.
- Rotate signing keys or rebuild artifacts produced by any build identified as suspicious.
Patch Information
The fix is included in BuildKit v0.33.1. See the GitHub BuildKit Release v0.33.1 notes and the GitHub Security Advisory GHSA-66hf-6vf5-87hc for release details and remediation guidance.
Workarounds
- Enforce policy validation on commit SHA, commit metadata, or signatures instead of relying on the asserted remote URL.
- Restrict who can submit or modify BuildKit build definitions to reduce exposure to crafted Git sources.
- Pin builds to trusted mirrors and block egress from build workers to arbitrary Git hosts at the network layer.
# Verify installed BuildKit version and upgrade if below v0.33.1
buildctl --version
# Example: upgrade the buildkitd container image
docker pull moby/buildkit:v0.33.1
docker rm -f buildkitd 2>/dev/null || true
docker run -d --name buildkitd --privileged moby/buildkit:v0.33.1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
