# Moby BuildKit.

Every CVE that names Moby BuildKit among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Malicious client could set xattr value outside of BuildKit state directory](https://agentprime.io/advisories/CVE-2026-121520.md)
  `CVE-2026-121520` · CVE record: Moby BuildKit · CVSS 4.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-61
- [Possible panic from Git source resolver](https://agentprime.io/advisories/CVE-2026-121522.md)
  `CVE-2026-121522` · CVE record: moby BuildKit · CVSS 6.7 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Memory corruption
- [Malformed LLB file operation can crash buildkitd](https://agentprime.io/advisories/CVE-2026-93321.md)
  `CVE-2026-93321` · CVE record: moby BuildKit · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-129
- [BuildKit proxy CA cleanup can be disrupted by build steps](https://agentprime.io/advisories/CVE-2026-93315.md)
  `CVE-2026-93315` · CVE record: moby BuildKit · CVSS 5.8 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Race condition
- [Crafted Git build source can bypass certain policy validation](https://agentprime.io/advisories/CVE-2026-93326.md)
  `CVE-2026-93326` · CVE record: moby BuildKit · CVSS 6.0 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-180
- [Oversized Dockerfile or .dockerignore can exhaust buildkitd memory](https://agentprime.io/advisories/CVE-2026-93323.md)
  `CVE-2026-93323` · CVE record: moby BuildKit · CVSS 6.8 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Denial of service
- [Malformed MergeOp can crash the BuildKit daemon](https://agentprime.io/advisories/CVE-2026-93322.md)
  `CVE-2026-93322` · CVE record: moby BuildKit · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-129
- [BuildKit improperly handles special files in build snapshots](https://agentprime.io/advisories/CVE-2026-93320.md)
  `CVE-2026-93320` · CVE record: moby BuildKit · CVSS 6.0 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-441
- [A malicious frontend can cause a daemon panic](https://agentprime.io/advisories/CVE-2026-93319.md)
  `CVE-2026-93319` · CVE record: moby BuildKit · CVSS 5.7 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-567
- [Cache poisoning via unvalidated image layer DiffIDs](https://agentprime.io/advisories/CVE-2026-93318.md)
  `CVE-2026-93318` · CVE record: moby BuildKit · CVSS 7.5 High · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-354
- [Container blob cache can accept unverified content](https://agentprime.io/advisories/CVE-2026-93317.md)
  `CVE-2026-93317` · CVE record: moby BuildKit · CVSS 5.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-354
- [Starting daemon with --cdi-disabled flag can lead to panic on specific builds](https://agentprime.io/advisories/CVE-2026-93316.md)
  `CVE-2026-93316` · CVE record: moby BuildKit · CVSS 7.1 High · Not analysed yet · Published 5 Oct 2026 · Tags: Memory corruption
- [BuildKit: Malicious client can bypass destination directory validation on local sources upload](https://agentprime.io/advisories/CVE-2026-75593.md)
  `CVE-2026-75593` · CVE record: moby buildkit · CVSS 7.2 High · Not analysed yet · Published 19 Aug 2026 · Tags: Path traversal
- [Git source checkout from a bundle file could lead to command injection](https://agentprime.io/advisories/CVE-2026-15793.md)
  `CVE-2026-15793` · CVE record: moby BuildKit · CVSS 6.5 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Command injection
- [Possible panic when incorrect parameters sent from frontend](https://agentprime.io/advisories/CVE-2026-15792.md)
  `CVE-2026-15792` · CVE record: moby BuildKit · CVSS 6.3 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-20
- [LLB file operation can be tricked to remove /tmp directory contents](https://agentprime.io/advisories/CVE-2026-15791.md)
  `CVE-2026-15791` · CVE record: moby BuildKit · CVSS 3.3 Low · Not analysed yet · Published 21 Jul 2026 · Tags: Path traversal
- [Malicious client can bypass destination directory validation on local sources upload](https://agentprime.io/advisories/CVE-2026-15789.md)
  `CVE-2026-15789` · CVE record: moby BuildKit · CVSS 6.9 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Path traversal
- [WCOW cache mount source selector resolves NTFS junctions outside of cache root](https://agentprime.io/advisories/CVE-2026-15788.md)
  `CVE-2026-15788` · CVE record: moby BuildKit · CVSS 5.6 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Path traversal

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=moby-buildkit>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/moby-buildkit/>. Everything for agents: <https://agentprime.io/llms.txt>.