Vulnerability · Published Oct 5, 2026 · Assigned by Docker
CVE-2026-93320BuildKit improperly handles special files in build snapshots
Medium 6.0
In plain English
A medium-severity security flaw in BuildKit from moby. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).
Severity (CVSS 4.0)6.0Medium
Exploit odds (30 days)0.1%top 98.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:26.04:LTS | docker.io | no fix listed | UBUNTU-CVE-2026-93320 |
| Ubuntu:26.10 | docker.io | no fix listed | UBUNTU-CVE-2026-93320 |
| Ubuntu:26.04:LTS | docker.io-app | no fix listed | UBUNTU-CVE-2026-93320 |
| Ubuntu:26.10 | docker.io-app | no fix listed | UBUNTU-CVE-2026-93320 |
Affected products (as reported)
Weakness: CWE-441 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:H/SA:H