MEDIUM 5.9 NVD
CVE-2026-93317
An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting sn
An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity.
References
- https://github.com/moby/buildkit/releases/tag/v0.33.1
- https://github.com/moby/buildkit/security/advisories/GHSA-p3rc-w3hc-pqvv
This medium severity vulnerability with a CVSS score of 5.9 was published on 2026-10-05 via NVD.
vulnfeed aggregates 7729 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.