CVE-2025-0495
MediumSummary
Buildx is a Docker CLI plugin that extends build capabilities using BuildKit. Cache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry traces.
Risk Assessment
Risk of credential leakage to monitoring systems, which could lead to unauthorized access.
Recommendation
Update Buildx to a version that includes a fix for this issue.
Original NVD description (English source)
Buildx is a Docker CLI plugin that extends build capabilities using BuildKit. Cache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry trac