CVE-2026-93325: Docker Buildx Filesystem Entitlement Bypass — Detection and Remediation Guide

---
title: Docker Buildx Build Against Remote or Untrusted Context
id: 4b7e2c91-8f3a-4d55-b2e6-9c1d5a7f3e21
status: experimental
description: Detects docker buildx build invocations sourcing build contexts from remote git or HTTP(S) URLs, a common delivery vector for malicious build content associated with CVE-2026-93325 exploitation.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-758/
  - https://attack.mitre.org/techniques/T1195/
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.supply_chain_compromise
  - attack.t1195.002
logsource:
  category: process_creation
  product: linux
detection:
  selection_cmd:
    CommandLine|contains:
      - 'buildx build'
  selection_context:
    CommandLine|contains:
      - 'git@'
      - 'https://github.com/'
      - 'http://'
      - 'https://'
      - 'git://'
  condition: all of selection_*
falsepositives:
  - Legitimate CI/CD pipelines building from version-controlled sources; tune by allowlisting known-good repository URLs
level: medium
---
title: BuildKit or Docker Daemon Spawning Suspicious Shell Activity
id: 9d1a4f67-2c8b-4e93-a5d1-6f8b2c4e9a37
status: experimental
description: Detects shells, downloaders, or scripting interpreters spawned as children of buildkitd, dockerd, or containerd — consistent with post-exploitation activity following a Docker Buildx entitlement bypass such as CVE-2026-93325.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-758/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/buildkitd'
      - '/dockerd'
      - '/containerd'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
  condition: all of selection_*
falsepositives:
  - Container health checks and legitimate entrypoint scripts executed under containerd; investigate context of parent process and command line before dismissing
level: high
---
title: Build Process Requesting Insecure BuildKit Entitlements
id: 2f6c8b14-5a9d-4e71-c3f8-8d2a6b1e4c59
status: experimental
description: Detects docker buildx invocations granting insecure BuildKit entitlements (--allow flags) or invoking custom build frontends, which can indicate an attempt to exercise the filesystem entitlement bypass in CVE-2026-93325 or unsafe build configuration.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-758/
  - https://attack.mitre.org/techniques/T1611/
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.privilege_escalation
  - attack.t1611
logsource:
  category: process_creation
  product: linux
detection:
  selection_cmd:
    CommandLine|contains:
      - 'buildx build'
      - 'buildx bake'
  selection_flags:
    CommandLine|contains:
      - '--allow security.insecure'
      - '--allow device'
      - '--allow network.host'
      - '--build-context'
      - '# syntax='
  condition: all of selection_*
falsepositives:
  - Rare; privileged builds in tightly controlled internal pipelines. Every hit warrants review of who initiated the build and from what source
level: high

// Hunt for Docker Buildx builds sourced from remote/untrusted contexts and suspicious daemon child processes
// Deploy via Microsoft Sentinel with Syslog/CEF ingestion from build hosts, or Defender for Endpoint on managed developer workstations
union isfuzzy=true
(DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where ProcessCommandLine has_any ("buildx build", "buildx bake")
| where ProcessCommandLine has_any ("github.com", "git@", "http://", "https://", "--allow", "--build-context")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine, SHA256
),
(Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_all ("buildx", "build")
| where SyslogMessage has_any ("github.com", "git@", "--allow", "security.insecure", "network.host")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
)
| sort by TimeGenerated desc

// Correlate: shell or downloader processes spawned under docker/buildkit daemons on build hosts
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("dockerd", "buildkitd", "containerd")
| where FileName in~ ("bash", "sh", "curl", "wget", "nc", "ncat", "python", "python3", "perl")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
| sort by TimeGenerated desc

-- Hunt for buildx builds using remote contexts or insecure entitlements across build hosts
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'buildx (build|bake)'
  AND CommandLine =~ '(github\.com|git@|https?://|--allow|--build-context|security\.insecure)'

-- Identify shell/downloader children of container daemons on the endpoint
SELECT Pid, Ppid, Name, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(bash|sh|curl|wget|nc|ncat|python[0-9.]*)$'
  AND Ppid IN (
    SELECT Pid FROM pslist()
    WHERE Name =~ '(dockerd|buildkitd|containerd)$'
  )

#!/usr/bin/env bash
# CVE-2026-93325 verification and hardening script for Docker Buildx build hosts
# Run on developer workstations, CI runners, and dedicated builder nodes

set -euo pipefail

echo "=== [1/5] Installed Buildx and Docker versions ==="
docker buildx version 2>/dev/null || echo "buildx plugin not found"
docker version --format '{{.Server.Version}}' 2>/dev/null || echo "docker daemon not reachable"
# Compare installed buildx version against the fixed release listed in the
# ZDI-26-758 advisory and Docker's GitHub security releases.
# If vulnerable, upgrade the plugin:
#   mkdir -p ~/.docker/cli-plugins
#   curl -sSL https://github.com/docker/buildx/releases/latest \
#     -o /tmp/buildx-release && docker buildx install <fixed-version>
# Or via package manager:
#   sudo apt-get update && sudo apt-get install -y docker-buildx-plugin

echo "=== [2/5] Enumerating builder instances and drivers ==="
docker buildx ls 2>/dev/null || true
# Flag any builders using the remote driver or running with --buildkitd-flags
# that weaken entitlement enforcement. Untrusted-content builds must never
# run on a builder that shares the host daemon or holds credentials.

echo "=== [3/5] Auditing buildkitd configuration for entitlement settings ==="
for cfg in /etc/buildkit/buildkitd.toml /etc/buildkitd.toml ~/.config/buildkit/buildkitd.toml; do
  if [ -f "$cfg" ]; then
    echo "--- $cfg ---"
    cat "$cfg"
  fi
done
# Ensure no configuration grants default entitlements. Entitlements must only
# be granted explicitly per-build by a human reviewer.

echo "=== [4/5] Checking for builds sourcing remote/untrusted contexts (shell history) ==="
grep -RhoE 'docker (buildx )?(build|bake)[^|;&]*(github\.com|git@|https?://)[^|;&]*' \
  /root/.bash_history /home/*/.bash_history 2>/dev/null | sort -u || echo "No remote-context builds found in history"

echo "=== [5/5] Verifying no lingering build containers or unexpected privileged containers ==="
docker ps -a --filter 'name=buildx_buildkit' --format 'table {{.Names}}\t{{.Status}}\t{{.Image}}' 2>/dev/null || true
docker ps --filter 'label=desktop.docker.io/mounts' --format 'table {{.Names}}\t{{.Image}}' 2>/dev/null || true

echo ""
echo "RECOMMENDATION: Route all builds of third-party content through isolated, ephemeral"
echo "builders (e.g., remote driver in a dedicated VM with no credentials mounted), pin"
echo "Dockerfile frontends by digest, and require code review before any --allow flag is used."