CVE-2026-93326 - Crafted Git build source can bypass certain policy validation

Back Back to CVE browser

MEDIUM

Crafted Git build source can bypass certain policy validation

Published Oct 5, 2026

6.0

MEDIUM

CVSS 4.0

EPSS 0.25%

Description

A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look like it is coming from a different remote URL than it really is when Git clone is happening. If policy is doing more stricter validation, for example based on commit SHA, commit data, or signatures, then all these validations still apply correctly.

Affected products

Vendor Moby Product BuildKit Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=0.33.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Moby

BuildKit

unaffected

Version	Status	Constraints
0	affected	<=0.33.0

Remediation

Vendor solution

Issue only affect special cases when running builds with optional Build policies with specific Git source rules. Only the Git source rules based on the repository URL are affected.

Weaknesses (1)

CWE-180

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-92787
Advisory
https://github.com/moby/buildkit/releases/tag/v0.33.1
patch
https://github.com/moby/buildkit/security/advisories/GHSA-66hf-6vf5-87hc
vendor-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-92787		Advisory
https://github.com/moby/buildkit/releases/tag/v0.33.1		patch
https://github.com/moby/buildkit/security/advisories/GHSA-66hf-6vf5-87hc		vendor-advisory