Incorrect Behavior Order: Validate Before Canonicalize Affecting github.com/moby/buildkit/source/git package, versions <0.33.1
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GITHUBCOMMOBYBUILDKITSOURCEGIT-20826438
- published11 Oct 2026
- disclosed5 Oct 2026
Introduced: 5 Oct 2026
NewCVE-2026-93326 Â (opens in a new tab)How to fix?
Upgrade github.com/moby/buildkit/source/git to version 0.33.1 or higher.
Overview
Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize through the Source.Identifier path in source/git/source.go and source/git/identifier.go. An attacker can make a build appear to use a different Git remote URL than the one in the source identifier by supplying a crafted git.fullurl value.
This lets repository-URL-based policy rules accept a source they should reject, enabling policy bypass for Git builds that rely on remote URL matching. Stricter checks based on commit SHA, commit contents, or signatures are not affected, but builds that gate access on the repository URL can be directed to an unexpected remote.
Notes
- The bypass only matters for builds that use optional Git source policy rules based on the repository URL; policies that validate the commit SHA, commit contents, or signatures are outside this issue’s effect.
- The crafted
git.fullurlvalue is validated against the source identifier’s host and repository path, so aliases that differ only in transport, credentials, case, query/fragment, or.gitsuffix normalization can still be accepted when they resolve to the same repository.