CVE-2026-93320: moby buildkit Confused Deputy
CVSS: 6.0v4.0MediumAwaiting analysis
AliasesUBUNTU-CVE-2026-93320
Published 05-10-2026Last modified 05-10-2026
Vulnerability summary
CVE-2026-93320 is a medium (CVSS 6.0) Confused Deputy vulnerability in moby buildkit. EPSS estimates a 0.11% chance of exploitation in the next 30 days, higher than 1.3% of scored vulnerabilities.
CVSS score
6.0/10
010
Medium · v4.0 (CVE.org)EPSS score
0.11%
0%100%
Low · Change unavailableKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 05-10-2026PublishedVulnerability first disclosed.
- 05-10-2026Last modifiedVulnerability information updated.
Description
BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access.
CVSS metrics
3 scores · 3 sources · 1 versionMedium 6.0Preferred score · CVE.org (CNA)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:H/SA:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated6.0MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:H/SA:H
- NVDNIST6.0MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.11%
Chance of exploitation in the next 30 days
Percentile
1%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
06-10-202620-10-2026
EPSS score0.11%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu2 products
- docker.ioAll versions (No fix recorded)
- docker.io-appAll versions (No fix recorded)
Moby1 product
- buildkit≤ 0.33.0
2 vendors · 3 products