CVE-2026-93326 Crafted Git build source can bypass certain policy validation
Attackers can bypass policy validation in BuildKit by crafting Git build sources to spoof remote URLs, undermining security controls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93326?
CVE-2026-93326 is a medium-severity vulnerability in moby BuildKit, published on 5 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look like it is coming from a different remote URL than it really is when Git clone is happening. If policy is doing more stricter validation, for example based on commit SHA, commit data, or signatures, then all these validations still apply correctly.
Weakness: CWE-180
Which versions are affected by CVE-2026-93326?
How do I fix CVE-2026-93326?
Apply the vendor's patch.
Is CVE-2026-93326 being exploited?
There is no known exploitation of CVE-2026-93326 in the wild and no public exploit code.
Sources
Also known as AZL-106812, BELL-CVE-2026-93326, GHSA-66hf-6vf5-87hc, UBUNTU-CVE-2026-93326.